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shown in the following screenshot: 


i MBSA Setup 


Welcome to the Microsoft Baseline Security Analyzer 
Version 2.3 


Microsoft Baseline Security Analyzer Setup 


It is strongly recommended that you exit all Windows programs before running this setup program. 


Click Cancel to quit the setup program, then close any programs you have running. Click Next to 
continue the installation. 


WARNING: This program is protected by copyright law and international treaties. 

Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe 
civil and criminal penalties, and will be prosecuted to the maximum extent possible under law. 
Copyright 2002-2013 Microsoft Corporation. All rights reserved. 


Figure 10 
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3. Click on I accept the license agreement, then press Next: 


te MBSA Setup 


License Agreement 


‘You must agree with the license agreement below to proceed. 


MICROSOFT SOFTWARE LICENSE TERMS 

MICROSOFT BASELINE SECURITY ANALYZER 2.3 

These license terms are an agreement between Microsoft Corporation (or 
based on where you live, one of its affiliates) and you. Please read them. They 
apply to the software named above, which includes the media on which you 
received it, if any. The terms also apply to any Microsoft 


* updates, 


e  ciinnlements 


@)| accept the license agreement 
O)| do not accept the license agreement 


< Back Cancel 


Figure 11 


4. On the destination folder page, press Next. 


5. On the start installation page, press Install, then the installation progress page 
will appear, as follows: 
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ff MBSA Setup 


Installation Progress 


Please wait 


Current Action: 
Registering modules 


File: xmldb. dll, Folder: C:\Program Files\Microsoft Baseline Security Analyzer 2‘, 


Cancel 


Figure 12: Installation progress 


6. Then, the setup will finish: 


# MBSA Setup 


Microsoft Baseline Security Analyzer Setup 
has completed successfully. 


Figure 13: Installation complete 
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7. A shortcut is placed on the desktop. Double-click it. The UAC prompt appears; 
click Yes: 


Figure 14: MBSA shortcut 


8. The MBSA Management console appears; click Scan a computer, then, at the 
bottom-right, click Start Scan: 


a Microsoft Baseline Security Analyzer 2.3 


Microsoft 
ne 
Baseline Security Analyzer 


Tasks Check computers for common security misconfigurations. 
Scan a computer 

The Microsoft Baseline Security Analyzer can check computers running Microsoft 
Windows 7, Windows® Server 2003, Windows Server 2008, Windows Vista, or 


Scan multiple computers 


administrator privileges for each computer you want to scan. 


About Microsoft Baseline 
Security Analyzer 
} Scan a computer 
Check a computer using its name or IP Address. 


Scan multiple computers 
Check multiple computers using a domain name or a range of IP addresses. 


View existing security scan reports 
View, print and copy the results from the previous scans. 


Figure 15: MBSA management console 


9. The scan starts and downloads security update information from Microsoft. As it 
compares computer updates against the latest updates for Windows 10, this will 
take about 10-15 minutes: 
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W Microsoft Baseline Security Analyzer 2.3 


Microsoft 


Baseline Security Analyzer 


J & 


Scanning... 


( 


Downloading security update information from Microsoft... 


Figure 16: Obtaining security updates from Microsoft 


10. The scan results page comes up; you will notice that the default is Score (worst 
first): 


® Microsoft Baseline Security Analyzer 2.3 


Microsoft 


Baseline Security Analyzer 


Report Details for WORKGROUP - DESKTOP-63TH92T (2018-08-09 21:52:12) 


q Security assessment: 
Incomplete Scan (Could not complete one or more requested checks.) 


WORKGROUP \DESKTOP-63TH92T 

172.24.249.193 

WORKGROUP - DESKTOP-63TH92T (09-08-2018 21-52) 
09/08/2018 21:52 

2.3.2211.0 

Security updates scan not performed 


Sort Order: 
Security Update Scan Results 
Score Issue Result 


{Security Cannot load security CAB file, 
Updates How to correct this 


Windows Scan Results 


@@ Print this report Copy to dipboard 3) Previous security report Next security report >] 


[oO] 


Figure 17 
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11. Scroll down and you will see that the MBSA is a vulnerability scanner that is 
used as a credentialed scan, and that it produces some good results. However, it 
is passive and informational, and did not try to exploit the computer at all: 


3 Microsoft Baseline Security Analyzer 2.3 


Microsoft 


Baseline Security Analyzer 


The Automatic Updates feature has not been configured on this computer. Please upgrade to the latest 
Service Pack to obtain the latest version of this feature and then use the Control Panel to configure 
Automatic Updates. 

What was scanned How to correct this 

More than 2 Administrators were found on this computer. 

What was scanned Result details How to correct this 

Some user accounts (4 of 5) have non-expiring passwords. 

What was scanned Result details + How to correct this 

No incomplete software update installations were found. 

What was scanned 

Windows Firewall is enabled and has exceptions configured. Window's Firewall is enabled on all network 
connections. 

What was scanned Result details © How to correct this 

Some user accounts (3 of 5) have blank or simple passwords, or could not be analyzed. 

What was scanned Result details 

All hard drives (2) are using the NTFS file system. 

What was scanned Result details 

Autologon is not configured on this computer. 

What was scanned 

The Guest account is disabled on this computer. 

What was scanned 


& Print this report [P) Copy to dipboard 


Figure 18: Credentialed vulnerability scan 


You can now see whether or not you have any vulnerabilities on your computer. There are 
hyperlinks below each item listed, giving you information on how to update your 
vulnerabilities. Look at each of these in turn and take the appropriate actions. 
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Review questions 


1. 


DRO FP WN 


23. 


24. 


If I install a freeware program that analyses my computer and then finds 40,000 
exploits and asks me to purchase the full version, what type of attack is this? 


. What is crypto-malware? 

. What type of virus replicates itself and uses either ports 4444 or 5000? 

. What type of virus inserts a .d11 into either the SysWow64 or System 32 folder? 
. What is a RAT? 

. What type of virus attacks the windows/system 32 folder on Windows, or the 


bin/ and /usr/bin/ on Linux? 


. How does a logic bomb virus work? 

. What is the purpose of a keylogger? 

. What is a botnet? 

. Explain a phishing attack. 

. How does spear phishing differ from a phishing attack? 

. What is a whaling attack? 

. What type of attack can include leaving voicemail? 

. What is social engineering tailgating? 

. What is social engineering? 

. What type of attack could involve dressing as a police officer? 
. What type of attack is it if a fireperson arrives and you let them into the server 


room to put out a fire? 


. What type of attack is it if 1am in an ATM queue and someone has their phone to 


one side so that they can film the transaction? 


. What type of attack is distributing fake software? 
. What is a watering hole attack? 
. What type of attack is it if I receive an email from my company's CEO, telling me 


to complete the form attached by clicking on a link in the email? 


. One of my bosses asks me to give them information that one of my peers gave 


them last week. I am not too sure, but I give them the information. What type of 
attack is this? 


What type of attack is a multiple SYN flood attack on a well-known website that 
takes it down? 


Explain a man-in-the-middle (MITM) attack. 
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25 


26. 


27. 
28. 
29. 
30. 
31. 
32. 
33. 
34. 
35. 


36. 
37. 
38. 
39. 
40. 
41. 
42. 
43. 
44. 
45. 
46. 
47. 
48. 
49. 
50. 
51. 
52. 
53. 


54. 
55. 


56. 


. How does a replay attack differ from a man-in-the-middle attack? 


What type of attack is a man-in-the-middle attack using an SSL3.0 browser that 
uses a Chain Block Cipher (CBC)? 


What type of attack is a man-in-the-browser attack? 

How can I prevent a replay attack in a Microsoft environment? 

How can I prevent a pass-the-hash attack? 

What type of attack uses HTML tags with JavaScript? 

What type of exploit has no patches and cannot be detected by NIDS or NIPS? 
What is domain hijacking? 

What is bluejacking? 

What is bluesnarfing? 


What type of attack does an attacker need to be local and how can I prevent that 
attack? 


For what type of attack would I use the strcpy tool? 

What is an integer overflow attack? 

What type of attack uses the phrase 1=1? 

Name two methods to prevent the type of attack in question 36. 
What type of attack is session hijacking? 

If I misspell a website but still get there, what type of attack is this? 
What type of attack would I use shimming or refactoring for? 
What type of system is susceptible to a birthday attack? 

What are rainbow tables? 

How can I store passwords to prevent a dictionary attack? 

Name two tools that can be used for key stretching. 

What is the fastest password attack that can crack any password? 
What is the only way to prevent a brute force attack? 

What can we do to slow down a brute force attack? 

What type of authentication is the most prone to errors? 

What is an evil twin? 

How can I prevent an attack by a rogue WAP? 

I am trying to use the internet but my wireless session keeps crashing—what 
type of attack is this? 

How close does an attacker need to be for an NFC attack? 


If I have no information on the system but at the last minute the IT manager 
gives me the local admin account, what type of penetration test is this? 


How much information does a black box pen tester have? 
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57. 
58. 
59. 
60. 
61. 
62. 


How much information does a white box pen tester have? 

Which type of vulnerability scan can I use for auditing? 

If I carry out a non-credentialed vulnerability scan, what will I find? 
What type of reconnaissance is it if I try to obtain a password reset? 
What type of reconnaissance is it if I actively listen? 

What is a pivot? 
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Answers and explanations 


1. 
De 


18. 


19. 


Because you have parted with money, this is a subtle form of ransomware. 


An example of crypto-malware is ransomware where the victim's hard drive is 
encrypted and held to ransom. 


. Aworm replicates itself and can use either ports 4444 or 5000. 
. A Trojan inserts a .d11 into either the Syswow64 or System 32 folder. 
. Aremote access Trojan is a Trojan that sends the user's username and password 


to an external source so that a remote session can be created. 


. A rootkit virus attacks the root in Windows in the /system 32 folder, or in 


Linux in the /usr/bin/ directory. 


. A logic bomb virus is triggered off by an event; for example, a Fourth of July 


logic bomb would activate when the date on the computer was July 4. 


. Akeylogger is a piece of software that could run from a USB flash drive plugged 


into the back of a computer, which then records all of the keystrokes being used. 
It can capture sensitive data that is typed in, such as bank account details and 
passwords. 


. A botnet is a group of computers that have been infected so that they can be used 


to carry out malicious acts without the real attacker being identified. They could 
be used for a DDoS attack. 


. A phishing attack is when a user receives an email asking them to fill in a form 


requesting their bank details. 


. Spear phishing is a phishing attack that has been sent to a group of users. 

. A whaling attack targets a CEO or a high-level executive in a company. 

. A vishing attack can use a telephone or leave a voicemail. 

. Social engineering tailgating is where someone has used a smart card or entered 


a pin to access a door, then someone behind them passes through the door before 
it closes, entering no credentials. 


. Social engineering exploits an individual's character in a situation that they are 


not used to. 


. Dressing as a police officer could be part of be an impersonation attack. 
. If you let a fireperson into the server room to put out a fire, that is a social 


engineering urgency attack. 

If 1am using an ATM and someone films the transaction, this is a subtle shoulder 
surfing attack. 

Fake software that will not install is a hoax. An email alert telling you to delete a 
system file as it is a virus is also a hoax. 
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20. 


21. 


22. 


23. 


24. 


25. 


26. 


27: 


28. 


29. 


30. 
31. 


32. 


33. 


34. 
35. 
36. 
37. 
38. 
39. 
40. 


41. 


A watering hole attack infects a website that a certain group of people visit 
regularly. 

An email that looks like it has come from your company's CEO, telling you to 
carry out an action is a social engineering authority attack. 


This is a social engineering consensus attack, where the person being attacked 
wants to be accepted by their peers. 


An attack with multiple SYN flood attacks is a DDoS attack. 


A man-in-the-middle (MITM) attack is where a connection between hosts is 
intercepted, replaying and changing the conversation, but the people involved 
still believe that they are talking directly to each other. 


A reply attack is similar to a man-in-the-middle attack, except the intercepted 
packet is replayed at a later date. 


A POODLE attack is a man-in-the-middle attack using an SSL3.0 browser that 
uses Chain Block Cipher (CBC). 


A man-in-the-browser attack is a Trojan that intercepts your session between 
your browser and the internet; it aims to obtain financial transactions. 


Kerberos authentication uses USN and timestamps and can prevent a replay 
attack, as the USN packets need to be sequential and the timestamps need to be 
in order. 


Disabling NTLM would prevent a pass-the-hash attack. 
XSS uses HTML tags with JavaScript. 


A zero-day virus has no patches and cannot be detected by NIDS or NIPS as it 
may take the anti-virus vendor up to five days to release a patch. 


Domain hijacking is where someone tries to register your domain, access your 
hosted control panel, and set up a website that is similar to yours. 


Bluejacking is hijacking someone's Bluetooth phone so that you can take control 
of it and send text messages. 


Bluesnarfing is when you steal someone's contacts from their Bluetooth phone. 
An ARP attack is a local attack that can be prevented by using IPSec. 

Strcpy can be used for a buffer overflow attack. 

An integer overflow inserts a number larger than what is allowed. 

An attack that uses the phrase 1=1 is an SQL injection attack. 

Input validation and stored procedures can prevent an SQL injection attack. 
Session hijacking is where your cookies are stolen so that someone can pretend to 
be you. 

Typosquatting is where an attacker launches a website with a similar name to a 
legitimate website in the hope that victims misspell the URL. 
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42. 
43. 
44. 


45. 


46. 
47. 


48. 


49. 


50. 


51. 
52. 


53. 


54. 


55. 


56. 
57. 
58. 
59. 


60. 
61. 


62. 


Shimming and refactoring are used for driver manipulation attacks. 
Digital signatures are susceptible to a birthday attack. 


Rainbow tables are pre-computed lists of passwords with the relevant hash in 
either MD5 or SHA1. 


Salting passwords inserts a random value and prevents dictionary attacks, as a 
dictionary does not contain random characters. 


Two tools that can be used for key stretching are bcrypt and PBKDF2. 
A brute force attack is the fastest password attack that will crack any password 
as it uses all combinations of characters, letters, and symbols. 


An account locked with a low value is the only way to prevent a brute force 
attack. 


If account lockout is not available, the best way to slow down a brute force attack 
is to make the password length longer or to salt passwords. 


Using passwords for authentication is more prone to errors as certificates and 
smart cards don't tend to have many errors. 


An evil twin is a WAP that is made to look like a legitimate WAP. 


Using an 802.1x authentication switch can prevent an attack by a rogue WAP, as 
the device needs to authenticate itself to attach to the switch. 


A wireless disassociation attack is where the attacker prevents the victim from 
connecting to the WAP. 


An attacker need to be within 4 cm of a card to launch an NFC attack. 


This is a gray box pen test; although the pen tester has no information that would 
make it black box, at the last minute, they are given a password, making it gray 
box. They are given some information. 


A black box pen tester has no information. 
A white box pen tester has all of the information available. 
A credentialed vulnerability scan can be used for auditing. 


A non-credentialed vulnerability scan can only see missing patches of the 
systems on your network. 


If I try to obtain a password reset, it is active reconnaissance. 

Listening is a passive reconnaissance technique; active listening means that you 
are concentrating on what is being said, and you are not taking any action. 

A pivot is where you gain access to a network so that you can launch an attack 
on a secondary system. 
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Implementing the Public Key 
Infrastructure 


Certificates are used for both encryption and authentication, and in this chapter, we are 
going to look at different encryption types and how certificates are issued and used. This is 
the most difficult module for students to understand, so we have focused on making the 
most difficult aspects seem easy. If you are going to be successful in the Security+ exam, 
you must know this module thoroughly. We will start with the Public Key Infrastructure 
(PKI), covering both the public and private keys. It is an asymmetric form of encryption. 


We will cover the following exam objectives in this chapter: 


e¢ Comparing and contrasting the basic concepts of cryptography: We will cover 
symmetric algorithms, modes of operation, asymmetric algorithms, hashing, salt, 
IV, nonce, elliptic curves, weak/deprecated algorithms, key exchange, digital 
signatures, diffusion, confusion, collision, steganography, obfuscation, stream 
versus block, key strength, session keys, ephemeral keys, secret algorithms, data- 
in-transit, data-at-rest, and data-in-use. We also look at random/pseudo-random 
number generation and key stretching. We then move on to implementation 
versus algorithm selection. We deal with crypto service providers and crypto 
modules. We look at perfect forward secrecy and security through obscurity. We 
cover common use cases, low-power devices, low latency, high resiliency, 
supporting confidentiality, supporting integrity, supporting obfuscation, 
supporting authentication, and supporting non-repudiation. We finally go into 
resources versus security constraints. 
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e Explaining cryptography algorithms and their basic characteristics: We will 
explore symmetric algorithms, AES, DES, 3DES, RC4, and Blowfish/Twofish. We 
then study cipher modes, CBC, GCM, ECB, CTR, and stream versus block. We 
then go into asymmetric algorithms, RSA, DSA, Diffie-Hellman, groups, DHE, 
ECDHE, elliptic curves, PGP/GPG, hashing algorithms, MD5, SHA1-HMAC, and 
RIPEMD. We'll look at key-stretching algorithms, BCRYPT, PBKDF2, 
obfuscation, XOR, ROT13, and substitution ciphers. 

¢ Implementing a PKI given a certain scenario: Here we'll cover components, CA, 
intermediate CA, CRL, OCSP, CSR, certificates, public keys, private keys, 
and Object Identifiers (OIDs). We also look into concept s, online versus offline 
CA, stapling, pinning, trust models, key escrow, and certificate chaining. Then 
we'll delve into types of certificates, wildcards, SAN, code signing, self- 
signed, machine/computer, email, users, root, domain validation, and extended 
validation. Finally, we'll get into certificate formats, DER, PEM, PFX, CER, P12, 
and P7B. 


PKI concepts 


The PKI provides asymmetric techniques using two keys: a public key and a private key. 
There is a certificate hierarchy, which is called the certificate authority, that manages, signs, 
issues, validates, and revokes certificates. Let's first look at the components of the certificate 
hierarchy. A certificate is known as an X509 certificate. 


Certificate hierarchy 


The Certificate Authority (CA) is the ultimate authority as it holds the master key, also 
known as the root key, for signing all of the certificates that it gives the Intermediary, 
which then in turn issues to the requester: 
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Figure 1: Certificate hierarchy 


e Online CA: An internal online CA is always up and running so that people in the 
company can request a certificate at any time of the day or night. This would not 
be the case in a government or top-security environment. 

e Offline CA: An offline CA is for a military or secure environment where 
clearance and vetting must be completed before someone can be issued a 
certificate. The CA is kept offline and locked up when it is not being used, but is 
taken out and switched to issue new certificates. After it issues a certificate, it 
goes back to being offline and is stored in the secure area. 
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Exam tip 

For Business-to-Business (B2B) transactions and working with other 
commercial companies, your X509 certificates need to come from a public 
CA. 


There are different types of CA: 


e Public CA: A public CA is also known as a third-party CA and is commercially 
accepted as an authority for issuing public certificates; examples include 
Comodo, Symantec, and Go Daddy. There are many more. The benefit of using a 
third-party CA is that all of the management is carried out by them; once you 
purchase the certificate, all you have to do is install it. They keep an up-to-date 
Certificate Revocation List (CRL) where you can check whether your certificate 
is valid. A certificate that is not valid will not work if you are going to sell goods 
and services to other companies; this is known as a B2B transaction, which 
requires a public CA. For example, I put petrol in my car and go to pay for the 
petrol. I give the attendant some monopoly money but they refuse to take it; this 
would be the equivalent of a private CA. Businesses will not accept it as 
payment. I then go to the cash machine outside and withdraw $100 and I give 
this to the attendant; he smiles and accepts it and gives me some change. This is 
the equivalent of a public CA. 


If you wish to trade and exchange certificates with other businesses, you 
need to get your certificate from a public CA. The certificate that follows has 
been issued to the Bank of Scotland from a public CA called DigiCert Global 
CA; you can see on the front of the certificate the purpose for use and also 
the dates that it is valid for. The X509 has an OID, which is basically the 
certificate's serial number—the same way that paper money has serial 
numbers: 
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a Certificate 


General Details Certification Path 


| R Certificate Information 


This certificate is intended for the following purpose(s): 
* Ensures the identity of a remote computer 


* Refer to the certification authority's statement for details. 


Issued to: www.nwolb.com 
Issued by: DigiCert Global CA G2 


Valid from 26/03/2018 to 26/03/2020 


Figure 2: Public CA-issued certificate 


e Private CA: A private CA can only be used internally; however, although it is 
free, you must maintain the CA. Hopefully, your company has the skill set to do 
so. 


¢ Certificate pinning: Certificate pinning prevents the compromise of the CA and 
the issuing of fraudulent X509 certificates. 

e Intermediary authority: The intermediary authority accepts the incoming 
requests for certificates and issues them once the CA has signed them. The 
certificates that are issued are known as X509 certificates. 
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Exam tip 
Certificate pinning prevents CA compromise and the issuing of 
fraudulent certificates. 


¢ Certificate architect: The certificate architect builds the CA, and if it is already 
present, he will build the intermediary authority. 

¢ Certificate chaining: Certificates in computer security are digital certificates that 
are verified using a chain of trust where the trust anchor for the digital certificate 
is the root CA. This chain of trust is used to verify the validity of a certificate as it 
includes details of the CRL. 


Certificate trust 


Certificates have some form of trust where the certificate can check whether or not it is 
valid. We are going to look at different trust models; you need to ensure that you know 
when each is used: 


e Trust anchor: A trust anchor in a PKI environment is the root certificate from 
which the whole chain of trust is derived; this is the root CA. 

Trust model: A trust model proves the authenticity of a certificate; there are two 
trust models: 

e Hierarchical trust model: This uses a hierarchy from the root CA 
down to the intermediary (also known as a subordinate); this is the 
normal PKI model. An example can be seen in the certificate 
hierarchy diagram. 

e Bridge trust model: The bridge trust model is peer to peer, where 
two separate PKI environments trust each other. The certificate 
authorities communicate with each other, allowing for cross 
certification; sometimes, it is referred to as the trust model. 


Certificate chaining: Certificates in computer security are digital certificates that 
are verified using a chain of trust where the trust anchor for the digital certificate 
is the root CA. This chain of trust is used to verify the validity of a certificate as it 
includes details of the CRL. 


Exam tip 
When two separate CAs trust each other, they will use a trust model 
called the bridge of trust. 
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e Web of trust: A web of trust is a concept used in PGP or various versions of PGP 
to establish the authenticity of the certificate being used. In PGP, two people are 
going to encrypt data between themselves; the first stage would be to give each 
other a public key so that they can encrypt the data being sent to the other party. 
It works with the same concepts as asymmetric encryption although it is on a 
smaller scale. 


Exam tip 
A bridge trust model is used so that two separate CAs can work with each 
other. 


Certificate validity 


Each time a certificate is used, the first thing that must happen is it must be checked for 
validity; there are three separate processes that you must know thoroughly, and these are 
as follows: 


CRL “ality 


CRL is Slow 


Stapling 


Figure 3: Certificate validity 


e Certificate Revocation List (CRL): The first stage in checking whether a 
certificate is valid, no matter the scenario, is to check the CRL. If the X509 is in the 
CRL, it is no longer valid and will not be accepted. No matter how obscure the 
question posed in the exam, unless it is going slow or it is a web server looking 
for a faster lookup, it will be the CRL that provides certificate validity. 
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¢ Online Certificate Status Protocol (OCSP): Only when the CRL is going slow 
will the OCSP come into play; it is much faster than the CRL and can take a load 
from the CRL in a very busy environment. 

¢ OCSP stapling/certificate stapling: Certificate stapling, also known as OCSP 
stapling, is used when a web server bypasses the CRL to use the OCSP for a 
faster confirmation when its certificate is valid. 


The validation of a certificate is done by the CRL unless it is going 
& slow—then it will be the OCSP doing this. 


Certificate management concepts 


We are now going to look at the different ways certificates are managed in a PKI 
environment, starting with the request for a new certificate and ending with different 
certificate formats. You must learn all of this information thoroughly as these aspects are 
heavily tested: 


¢ Certificate Signing Request (CSR): This is the process of requesting a new 
certificate; the process for the exam is that two keys are generated and the public 
is sent to the CA, which then returns a file, the X509: 


Key Escrow 


Holds Private Keys 
for 3" Parties 


Stores Keys 


Data Recovery | | 


Agent 


HSM 


Secure and Manages 
Keys 


Figure 4: Key escrow 
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e Key escrow: The key escrow holds the private keys for third parties and stores 
them in a Hardware Security Module (HSM). 

e Hardware Security Module (HSM): The HSM can be a piece of hardware 

attached to the server or a portable device that is attached to store the keys. See 

the preceding diagram for more on this. 

Data Recovery Agent (DRA): If a user cannot access their data because their 

private key is corrupted, the DRA will recover the data. The DRA needs to get 

the private key from the key escrow. 


The key escrow stores private keys for third parties. 


Certificates: There are two main certificate types: the public key and the private 
key. The public key is sent to third parties to encrypt the data, and the private 
key decrypts the data. If you think of the private key as your bank card, that's a 
thing you wouldn't give away. The public key is the deposit slip that is tied to 
your account—if you were in a room with 20 people who wanted to pay $20 into 
your account, you would definitely give them your deposit slip. You will always 
give your public key away because when you are encrypting data you will 
always use someone else's public key. 


A web server will use certificate stapling to bypass the CRL and use the 
é> OCSP for faster certificate validity. This is also known as OCSP stapling. 


e OIDs: The OID on a certificate is similar to a serial number on a bank note. Bank 
notes are identified by their serial number. The certificate is identified by its OID. 


e Certificate formats: There are different certificate formats, and these are as 
follows: 


Certificate pe 


PEM |Base6d format 
DER [Extension for PEM 
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The certificate equivalent of a serial number is the OID located on the 
X509 itself. 


Certificate types 


As a security professional, you will be responsible for purchasing new certificates, and 
therefore you must learn the certificate types thoroughly to ensure that you make the 
correct purchases. We will start with the self-signed certificate, which can roll out with 
applications such as Microsoft Exchange Server or Skype and finish with extended 
validation where the certificate has a high level of trust: 


Self-signed certificate: A self-signed certificate is issued by the same entity that 
is using it. However, it does not have a CRL and cannot be validated or trusted. 
Wildcard: For a wildcard certificate for a domain called ianneil501.com, the 
wildcard certification would be ianneil501.comand could be used for the 
domain and a subdomain. For example, in the iannei1501.com domain, there are 
two servers called web and mail. The wildcard certification is ianneil501.com, 
and when installed it would work for the Fully Qualified Domain Names 
(FODNSs) of both of these—these would be web. ianneil501.comand 
mail.ianneil501.com. A wildcard can be used for multiple servers in the same 
domain. 


PEM uses a Base64 certificate. 


Domain validation: A Domain-Validated (DV) certificate is an X.509 (https: // 
en.wikipedia.org/wiki/x.509) certificate that's typically used for Transport 
Layer Security (TLS) (https: //en.wikipedia.org/wiki/Transport_Layer_ 
Security) where the domain name (https://en.wikipedia.org/wiki/Domain_ 
name) of the applicant has been validated by proving some control over a DNS 
domain (https://en.wikipedia.org/wiki /Domain_name). 

Subject Alternative Name (SAN): A SAN certificate can be used on multiple 
domain names, such as abc. comor xyz.com, where the domain names are 
completely different, but they can use the same certificate. 
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e Code signing: Code-signing certificates are used to digitally sign software so that 
its authenticity is guaranteed. 


¢ Computer/machine: A computer or machine certificate is used to identify a 
computer within a domain. 


¢ User: A user certificate provides authenticity to a user for the applications that 
they use. 


A wildcard certificate can be used on several servers in the same domain. 
A SAN certificate can be used on servers in different domains. 


Extended validation: Extended validation certificates provide a higher level of 
trust in identifying the entity that is using the certificate. It would normally be 
used in the financial arena. You may have seen it in action where the background 
of the URL turns green. Companies applying for the certificate would have to 
provide more detailed information about the company. See the following 
screenshot: 


File Edi} -View - -Farourites~ ~ Touts ~ Herp 


& 


Personal Premier Business 


Products Support 


Online Banking 
Online banking 


Welcome to Online Ban 


Figure 5: Extended validation 
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Asymmetric and symmetric encryption 


There are two main types of encryption that use certificates, and these are asymmetric and 
symmetric; we need to learn about each thoroughly. Let's start by explaining what 
encryption is; please remember that you are taking plaintext and changing it into 
ciphertext. 


Encryption explained 


Encryption is where we take plaintext that can be easily read and convert it into ciphertext 
that cannot be easily read. For example, if we take the word pass in plaintext, it may then 
be converted to UDVV; this way, it is difficult to understand: 


e Substitution cipher: Julius Caesar, who died in 44 BC, invented the first 
substitution cipher, where he moved each letter of the alphabet three places one 
way or another. This way, he could make his military plans unreadable if they 
had been intercepted. What he forgot about was that most people in those days 
could not read! This was called ROT 3, after the three-letter rotation, and is now 
known as the Caesar cipher. For example, if I take the word "echo" and move 
each letter it on three places to the right in the alphabet sequence, you will get the 
word "hfkr'"—that would be difficult for someone to read and understand. 


ROT 13: ROT 13 is a variation of the Caesar cipher; as there are 26 letters in the 
alphabet, we are rotating the letters 13 times. The key to ROT 13 would be as 


follows: 


letter fA Bc De OF OG] Sk BS sk OM 
Rori3 IN oP fa Rs of} ff 


letter SIN, fo CP Rs fr} ft we 
Romig, Ae fF Oe Ot kK CO MT 
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When receiving the message GVZR SBE GRN, we would apply ROT 13, but instead of going 
forward 13 places to decipher, we would simply go back 13 places, and the message would 


be TIME FOR TEA. 


cannot be read. 


Exam tip 
> Encryption is taking plaintext and changing it into ciphertext so that it 


There are two types of encryption that use certificates: asymmetric and symmetric; let's 
look at each of these in turn: 


Symmetric encryption: Symmetric encryption only uses one key, which is 
known as the private or shared key. The same key encrypts and decrypts the 
data. The danger of symmetric encryption is that if the key is stolen, the attacker 
gets the keys to the kingdom. The main reason for using symmetric encryption is 
that it can encrypt large amounts of data very quickly. The Security+ exam does 
not focus on key exchange because it only uses one key, but instead looks at 
which is the fastest or strongest symmetric key, and which is used for the 
encryption of large amounts of data. 

Diffie Hellman (DH): When symmetric data is in transit, it is protected by Diffie 
Hellman, whose main purpose is to create a secure tunnel for symmetric data to 
pass through. 

DH groups: DH groups specify the strength of the key. For example, group 1: 
768-bit, group 2: 1024-bit, group 5: 1536-bit, group 14: 2048-bit, and so on. DH 
group 19: 256-bit elliptic curve is acceptable, and so is group 20: 384-bit elliptic 
curve. 

Asymmetric encryption: Asymmetric encryption uses two keys—a private key 
and a public key—and is also known as a PKI, complete with its CA and 
intermediary authorities. The Security+ exam tests the use of both the private and 
public keys very thoroughly. I have created a diagram to help you understand 
the purpose of each key. We use the mnemonic South-East-Distinguished- 
Visitor (SEDV). 
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The first stage in encryption is the key exchange; you will always keep your private key 
and give away your public key. You will always use someone else's public key to encrypt: 


Oe. 
sivas r 7 


Figure 6: Asymmetric key exchange 


In the preceding diagram, there are two different key pairs: the black key pair and the 
white key pair. These work together. Remember: the private key is your bank card, but the 
public key is your deposit slip—you will give it away so that people can pay money into 
your account. 


The person who is sending the data is on the From side and the person receiving the data is 
on the To side. 


A good way to remember the labels would be to think of South-East on the left-hand side 
and Distinguished- Visitor on the right. These labels stand for the following: 


e S: Sign (digital signature) 
e E: Encryption 
e D: Decryption 
e V: Validation 
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For example, Bob wants to encrypt data and send it to Carol; how is this done? Let's look at 
the following diagram. We can see that Bob owns the black key pair and Carol owns the 
white key pair. The first thing that needs to happen before encryption can happen is that 
they each give the other person their public key: 


—_ | D 


Figure 7: Bob encrypting data 


You can see the under the column for Bob that he has his private key, which he will always 
keep, and the public key that Carol has given him. In the preceding diagram, you can see 
the label E, for encryption, and therefore Bob uses Carol's public key to encrypt the data. 
Then, under Carol, you can see the letter D, for decryption; therefore, when the encrypted 
data arrives, Carol uses the other half of the white key pair, the private key, to decrypt the 
data. 


Exam tip 
Encryption stops the data being read by changing plaintext to ciphertext. 
A digital signature ensures that the data has not been altered as it creates a 


hash of the message, but the original data can be read. 
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Digital signatures explained 


When we send an email or document to someone, it could be intercepted in transit and 
altered. Your email address could be spoofed and someone could send an email as if it was 
from you, but there is no guarantee of integrity. Do you remember in Chapter 1, 
Understanding Security Fundamentals, that we used hashing to provide the integrity of data, 
but in emails we use a digital signature? We sign the email or document with our private 
key and it is validated by our public key. 


The first stage in digital signatures is to exchange public keys—the same principle as 
encryption. 


For example, George wants to send Mary an email and he wants to ensure that it has not 
been altered in transit. See the following diagram: 


Private | Private 


— 


E Public ~ Public 


Figure 8: Digital signature 


In the preceding diagram, you can see that George is going to sign the email with his 
private key when he sends it to Mary; she validates it with the public key that George has 
already given to her. When the email has been validated, she knows that the email has not 
been tampered with. 
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When people are asked to sign contracts, they sometimes use a third-party provider that 
asks them to digitally sign the contract; this then makes the contract valid as the digital 
signature proves the identity of the signatory. 


Then there's non-repudiation. When I complete a digital signature, I am using my private 
key, which I should never give away to sign the email or document, proving that it has 
come has come from me. Non-repudiation means that I cannot deny that it was me who 
signed the document. I could not say it was done by someone else. In the early 6th century, 
King Arthur would send messages to his knights on a parchment scroll and then would put 
his wax seal on the scroll to prove it came from him. The digital signature in modern life is 
doing the same—it is proving who it came from. The digital signature creates a one-way 
hash of the entire document, so it also provides integrity similar to hashing. 


Exam tip 
GD Always use someone else's public key to encrypt data. Never give your 


private key away. 


Cryptography algorithms and their 
characteristics 


If we look at symmetric and asymmetric keys, they use a cipher that has a number of bits 
attached to it—the lower the number, the faster and the higher the bits. The slower one, 
however, the one with the higher number of bits, is stronger. 


For example, we have two people who are going to complete a challenge—they are Usain 
Bolt, who is DES, a 56-bit key; and we have King Arthur wearing armor, who has an RSA of 
4,096 bits. The first part of the challenge is a 100-meter dash, in which Usain Bolt wins and 
King Arthur is held back by the weight of his armor, 90 meters behind. The second part of 
the challenge is a boxing match, and Usain keeps hitting King Arthur, who keeps laughing 
at him as he is being protected by his armor. Then, out of the blue, King Arthur lands a 
knockout blow to Usain. Since the challenge was for charity and the result was a draw, they 
are both happy. 


Concept 
The smaller the key, the faster it is, but the more insecure it is. The higher 
the key, the slower it is, but the more secure it is. 
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Symmetric algorithms 


For the Security+ exam, you must know the characteristics of each of the symmetric 
algorithms, from when it is used to its key length. Remember, they will never ask you 
which key encrypts or decrypts, as the answer would always be the private key, also 
known as the shared key. Let's look at each of these characteristics in turn: 


Advanced Encryption Standard (AES): AES comes in three key strengths: 128-, 
192-, and 256-bits. AES is commonly used for L2TP/IPSec VPNs. 

Data Encryption Standard (DES): DES groups data into 64-bit blocks, but for the 
purpose of the exam it is seen as a 56-bit key, making it the fastest but weakest of 
the symmetric algorithms. This could be used for L2TP/IPSec VPNs, but is 
weaker than AES. 

Triple DES (3DES): 3DES applies the DES key three times and is said to be a 168- 
bit key. This could be used for L2TP/IPSec VPNs, but is weaker than AES. 


Rivest Cipher 4 (RC4): RC4 is 40 bits and is used by WEP and is seen as a stream 
cipher. 

Blowfish/Twofish: Blowfish is a 64-bit key and Twofish is a 128-bit key, and 
both were originally designed for encryption with embedded systems. How can 
you remember which of these is faster as they have similar names? Easy. I have a 
pond with fish inside and I have a challenge with a guy called Tom. I need to 
catch two fish from the pond and he only needs to blow into the air. Guess what? 
He will win each time. Therefore, remember, Blowfish is faster than Twofish. 
Diffie Hellman: When using symmetric encryption, symmetric algorithms need 
DH to create a secure tunnel before they can transfer encrypted data. DH is 
asymmetric as it uses public and private keys; it does not encrypt data, but its 
role is to create a secure session. 


Asymmetric algorithms 


Asymmetric algorithms use a PKI environment as they use two keys: a private key and a 
public key. Let's now look at different asymmetric techniques: 


Diffie Hellman: DH does not encrypt data; its main purpose is to create a secure 
session so that symmetric data can travel down it. The DH handshake is shown 
in the following diagram: 
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IKE 


ISAKMP Protocol 


UDP Port 500 


ESP 


DES 3DES 
AES 


Figure 9: Diffie Hellman 


DH creates the keys used in the Internet Key Exchange (IKE); it uses UDP port 500 to set 
up the secure session for the L2TP/IPSec VPN. Once the secure tunnel has been created, 
then the symmetric encrypted data flows down the tunnel. 


Rivest, Shamir, and Adelman (RSA): RSA is named after the three people who 
invented the algorithm. The keys were the first private and public key pairs, and 
they start at 1,024, 2046, 3,072 and 4,096 bits. They are used for encryption and 
digital signatures. 
Digital Signature Algorithm (DSA): DSA keys are used for digital signatures; 
they start at 512 bits, but their 1,024-bit and 2046-bit keys are faster than RSA for 
digital signatures. 
Elliptic Curve Cryptography (ECC): ECC is a small, fast key that is used for 
encryption in small mobile devices; however, AES-256 is used in military mobile 
telephones. 
Ephemeral keys: Ephemeral keys are short-lived keys; they are used for a single 
session, and there are two of them: 

e Diffie Hellman Ephemeral (DHE) 


e Elliptic Curve Diffie Hellman Ephemeral (ECDHE) 


Pretty Good Privacy (PGP): PGP is used between two users to set up an 
asymmetric encryption and digital signatures. For PGP to operate, you need a 
private and public key pair. The first stage in using PGP is to exchange the keys. 
It uses RSA keys. 


GnuPG: GnuPG is a free version of the OpenPGP; it is also known as PGP. It 
uses RSA keys. 
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Symmetric versus asymmetric analogy 


If we think of encryption as playing table tennis where each person has just one bat and the 
pace is extremely fast, this is similar to asymmetric encryption as it uses one key. 


Then, if we change the game and we give the players two bats — the first bat to stop the ball 
and the second bat to turn the ball - this would be much slower. 


The same can be said for encryption; asymmetric encryption is much more secure as it has 
two keys and uses DH, an asymmetric technique for setting up a secure tunnel for the 
symmetric data. Symmetric encryption uses a block cipher and encrypts large blocks of 
data much faster than the asymmetric technique. 


XOR encryption 


The binary operation Exclusive OR (XOR) is a binary operand from Boole algebra. This 
operand will compare two bits and will produce one bit in return: 


e Two bits that are equal: 0 
e Two bits that are different: 1 


This is the opposite to binary. For example, we are going to use the word t read in ASCII 
format and then we are going to insert a key using the word hello so that we can complete 
an XOR operation. See the following diagram: 


T R E A D 


XOR 01010100 01110010 01100101 01100001 01100100 
(Original Input) 
Key 01101000 01100101 01101100 01101100 01101111 


Output 00111100 00010111 00001001 00001101 00001011 


Figure 10: XOR 


XOR encryption is commonly used with AES, several symmetric ciphers, and a one-time 
pad. 
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Key-stretching algorithms 


The concept of key stretching is to insert a random set of characters to increase the size of 
the password hash, making things harder for a brute-force attack: 


¢ BCRYPT: BCRYPT is a password-hashing algorithm based on the Blowfish 
cipher. It is used to salt the passwords; a random string is inserted to increase the 
password length to help protect against rainbow table attacks. It also has an 
adaptive function where the iteration count can be increased to make it slower, 
so it remains resistant to attacks even with increasing computation power. 

¢ PBKDF2: PBKDF2 stores passwords with a random salt and with the password 
hash using HMAC; it then iterates, which forces the regeneration of every 
password and prevents any rainbow table attack. 


Cipher modes 


There are different cipher modes; most symmetric keys use a block cipher and can encrypt 
a large amount of data quicker than asymmetric encryption. Let's look at these in turn: 


e Stream cipher: A stream cipher (https: //searchsecurity.techtarget .com/ 
definition/cipher) is a method of encrypting text (to produce ciphertext 
(https://whatis.techtarget .com/definition/ciphertext)) in which a 
cryptographic key and algorithm (https://whatis.techtarget.com/ 
definition/algorithm) are applied to each binary digit (https: //whatis. 
techtarget .com/definition/bit-binary-digit) ina data stream, one bit at a 
time. In this mode, only one key is used. It uses symmetric encryption but is not 
commonly used today as it is easy to crack. 

Block cipher: A block cipher is where a block of data is taken and then 
encrypted; for example, 128 bits of data may be encrypted at a time. This is the 
method used today as it is much faster than a stream cipher. 


Stream versus block cipher analogy 


We have two teams of four people who have been tasked with unloading a five-ton lorry 
full of skittles and placing them in a room on the bottom floor of a building. 
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There are skittles in boxes and there are skittles that have been placed loose. One of the 
teams has loose skittles that need to be bagged and the other lorry has boxes of skittles. It is 
obvious that the team with boxes of skittles will win: 


¢ Initialization Vector (IV): This is an arbitrary number that can be used along 
with a secret key for data encryption. This number, also called a nonce, is 
employed only one time in any session. The IV length is usually comparable to 
the length of the encryption key or the block of the cipher in use. Sometimes, this 
is also known as a starter variable. 

Cipher Block Chaining (CBC): CBC adds XOR to each plaintext block from the 
ciphertext block that was previously produced. The first plaintext block has an IV 
that you XOR; you then encrypt that block of plaintext. See the following 
diagram: 


Plaintext J Plaintext 


| 
r—--—a | 
| zs 


Block Cipher Block Cipher Block Cipher 
Encryption Encryption Encryption 


SS 


Ciphertext 


Ciphertext Ciphertext 


Figure 11: CBC 


The next block of plaintext is XOR'd against the last encrypted block before 
you encrypt this block. When decrypting a ciphertext block, you need the 
XOR from the previous ciphertext block. If you are missing any blocks, then 
decryption cannot be done. 


e Electronic Code Book (ECB): ECB replaces each block of the clear text with the 
block of ciphertext. The same plaintext will result in the same ciphertext. The 
blocks are independent from the other blocks. CBC is much more secure. 
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Galois/Counter Mode (GCM): This is a block cipher mode of operation that uses 
universal hashing over a binary Galois field to provide authenticated encryption. 
It can be implemented in hardware and software to achieve high speeds with low 
cost and low latency. 

Counter Mode (CTR): CTR turns a block cipher into a stream cipher. It generates 
the next key stream block by encrypting successive values of a counter rather 
than an IV. 


Hashing and data integrity 


Hashing is where the data inside a document is hashed using an algorithm, such as a 
Secure Hash Algorithm version 1 (SHA1) or MD5. This turns the data inside the file into a 
long text string known as a hash value; this is also known as a message digest. 


While you are hashing the same data, if you copy a file and therefore have two files 
containing the same data, then hash them with the same hashing algorithm, it will always 
produce the same hash value. Please look at the following example: 


Verifying integrity: During forensic analysis, a scientist takes a copy of the data 
prior to investigation. To ensure that they have not tampered with it during 
investigation, they will hash the data before starting and then compare the hash 
to the data when finished. If the hash matches, then they know that the integrity 
of the data is intact. 

One-way function: For the purpose of the exam, hashing is a one-way function 
and cannot be reversed. 

HMAC authentication: In cryptography, an HMAC (sometimes known as either 
keyed-hash message authentication code or hash-based message authentication 
code) is a specific type of Message Authentication Code (MAC) involving a 
cryptographic hash function and a secret cryptographic key. We can have 
HMAC-MD5 or HMAC-SHA1; the exam looks at both data integrity and data 
authentication. 

Digital signatures: Digital signatures are used to verify the integrity of an email 
so that you know it has not been tampered with in transit. The private certificate 
used to sign the email creates a one-way hash function, and when it arrives at its 
destination, the recipient has already been given a public key to verify that it has 
not been tampered with in transit. This will be covered in more depth later in this 
book. 
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as a digitally signed email could still be read; it only verifies integrity. If 
you wish to stop someone reading the email in transit, you need to 


Gp Can you read data that has been hashed? Hashing does not hide the data, 
encrypt it. 


e RIPEMD: This is a 128-bit hashing function. RIPEMD has been replaced by 
RIPEMD-160, RIPEMD-256, and RIPEMD-320. For the purpose of the exam, you 
need to know that it can be used to hash data. 


Comparing and contrasting the basic 
concepts of cryptography 


The most common asymmetric algorithms include the DH algorithm, which creates a 
secure session so that symmetric data can flow securely. An example of this would be the 
L2TP/IPsec VPN. RSA is the most commonly used asymmetric algorithm, and was the very 
first of its kind, creating public and private key pairs. ECC is an asymmetric algorithm used 
for the encryption of small mobile devices. 


Asymmetric — PKI 


Asymmetric keys are obtained from a CA. If you are selling products or services with 
external entities, then you need to obtain your X509s from a public CA, otherwise your 
internal certificates will not be accepted. 


Asymmetric — weak/depreciated algorithms 


An SSL should now be depreciated as it is weak; an example of an exploit is the POODLE 
attack, which is a man-in-the-middle attack that exploits the vulnerabilities of SSL 3.0 and 
SSL 3.0 (CBC). Asymmetric algorithms should not be using a key whose strength is 2,046 or 
lower. However, an SSL VPN is the only VPN that uses an SSL certificate and works with 
legacy clients. 
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Asymmetric — ephemeral keys 


Ephemeral keys are short-lived keys that are used for a one-time only session. There are 
two types of Diffie Hellman: Ephemeral (DHE) and Elliptic Curve Diffie Hellman 
Ephemeral (ECDHE). The other keys, used for other asymmetric and symmetric 
encryption, are known as static keys, as they have about a two-year lifespan. 


Symmetric algorithm — modes of operation 


Symmetric encryption involves a stream cipher that encrypts data one bit at a time; this is 
easy to crack and is much slower than a block cipher. Block cipher mode takes blocks of 
data depending on the key and encrypts that data in blocks—this makes the encryption of a 
large amount of data much faster. 


In an L2TP/IPSec VPN tunnel, we have a choice of three different versions of symmetric 
encryption; the weakest is DES, which has a 56-bit key, followed by 3DES, which has a 168- 
bit key. The most secure is AES, as it can go from 128 bits up to 256 bits. Remember, 
symmetric encryption has only one key. It is much faster for encrypting a larger amount of 
data, but it needs DH, an asymmetric technique, to create a secure tunnel before it is used. 


Symmetric encryption — streams versus block ciphers 


Symmetric encryption uses a block cipher, where blocks of data are encrypted. The key size 
determines how large the block of data is; for example, if I use DES, then I can only encrypt 
blocks of 56 bits, whereas AES can encrypt blocks of data of up to 256 bits. 


Asymmetric encryption encrypts one bit at a time, therefore it is slower but more secure 
than symmetric encryption as it uses a larger key size and uses two keys: public and 
private. 


Symmetric encryption — confusion 


Confusion massively changes the input to the output by putting it through a non-linear 
table created by the key. 


Symmetric encryption — secret algorithm 


A secret key is the piece of information that is used to encrypt and decrypt messages in 
symmetric encryption. 
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Symmetric — session keys 


A session key is an encryption and decryption key that is randomly generated to ensure the 
security of a communications session between a user and another computer or between two 
computers. A RADIUS server could create a session key for a user being authenticated. 


Hashing algorithms 


A hashing algorithm takes the data from a document and generates a hexadecimal value 
from that input. If you take the same data and hash it with the same algorithm, it will 
generate the same hash. In the Security + exam, the hashing algorithms are SHA-1, which is 
160 bits, and MD5, which is 128 bits. Hashing is a one-way function to ensure that the 
integrity of the data is intact. 


Crypto service provider 


A crypto service provider is a software library. For example, Microsoft uses the CryptoAPI 
and has providers such as the following: 


¢ Microsoft AES cryptographic provider: This service provider provides support 
for the AES algorithm. 

¢ Microsoft DDS and DH/channel cryptographic provider: This supports hashing 
and data signing with DSS and key exchanging for DH. 


Crypto module 


A crypto module is a combination of hardware and software that implements crypto 
functions such as digital signatures, encryption, random number generation, and 
decryption. 
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Protecting data 


One of the key functions of a security team is protecting a company's data, as it is difficult 
to put a price on lost data. Let's look at three types of data: at rest, in use, and in transit: 


e Data-at-rest: Data-at-rest is data that is not being used and is stored either on a 

hard drive or external storage; let's look at the different devices: 

¢ Desktops and laptops: We could use, for example, Bitlocker, 

which is known in the Security + exam as full disk encryption. 
However, the desktop or laptop would need a TPM chip built into 
the motherboard. We could also use Data Loss Prevention (DLP) 
to prevent someone stealing the data with a USB drive. 
Tablets/phones: Tablets and phones will need Full Device 
Encryption (FDE) to encrypt the device so that data cannot be 
stolen. 


e USB or removable drive: For removable devices, we should use 
full disk encryption so that if the drive is lost or stolen, the data 
will not be readable. 


e Data-in-transit: When we are using the internet to purchase items, we use https 
to encrypt the session before we enter the credit card details. If we are outside of 
the company, we would use a VPN session to tunnel into the workplace to access 
data. TLS will be used to encrypt emails as they travel between mail servers. 

e Data-in-use: When we use memory on a device, it is in the Random Access 
Memory (RAM) or a faster block of memory called the CPU cache. We can 
protect this data by using full memory encryption. 


Basic cryptographic terminology 


The Security+ exam is full of cryptographic terminology, and in this section, we are going to 
look at this terminology, starting with obfuscation, which makes the code obscure. Try 
asking your family and friends to say the word "obfuscation" and watch them struggle. It is 
aptly named as the word itself is very obscure! You must know the terminology 
thoroughly. 


Obfuscation 


Obfuscation is the process where you take source code and make it look obscure, so that if 
it was stolen, it would not be understood. 
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Pseudo-random number generator 


Pseudo-Random Number Generator (PRNG) refers to an algorithm that uses 
mathematical formulas to produce sequences of random numbers. Random numbers can be 
used when generating data encryption keys. 


Nonce 


A nonce is an arbitrary number that can be used just once; it is often a random (https: // 
en.wikipedia. org/wiki/Randomness) or pseudo-random (https://en.wikipedia.org/ 
wiki/Pseudorandomness) number issued in an authentication protocol (https: //en. 
wikipedia.org/wiki/Authentication_protocol1) to ensure that old communications 
cannot be reused in replay attacks (https: //en.wikipedia.org/wiki/Replay_attack). 


Perfect forward secrecy 


When a VPN makes a secure connection, a key exchange is made for each secure session, 
but it links to the server's private key. With perfect forward secrecy, there is no link 
between the session key and the server's private key; therefore, even if the VPN server has 
been compromised, the attacker cannot use the server's private key to decrypt the session. 


Security through obscurity 


The concept of security through obscurity is to prevent anyone from outside the 
organization from knowing the architecture or design of the system or any of its 
components. The internal people are aware of the weaknesses of the system, but you want 
to prevent an outside person from knowing anything about the system. Obfuscation is a 
technique that makes stored source code unreadable. 


Collision 


If you hash the same data or password with MD5 or with SHA-1, then it will always create 
the same hash. Hashes are used to store passwords or digitally sign documents. A collision 
attack is where the attacker tries to match the hash; if the hash is matched, it is known as a 

collision, and this could compromise systems. 
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Steganography 
Steganography is where a document, image, audio file, or video file can be hidden inside 
another document, image, audio file, or video file. 


Diffusion 


Diffusion is a technique where you change one character of the input, which will change 
multiple bits of the output. 


Implementation versus algorithm 


In today's world, security administrators need to look at how the company operates to 
ensure it is more secure. Do they want to implement smart cards for multifactor 
authentication or implement a VPN so that remote users can connect to the company 
securely? Do they need to implement a DLP template to ensure that sensitive data cannot 
be emailed from the company? 


Once the company vision has been decided, the security team needs to look at the 
algorithms that they need. Normally, this would be the strongest possible; however, we 
need to ensure that the server has enough processing power to deal with any increase in 
key length. We should not be using a key of less that 2,046 bits, as it would be too insecure. 


Common use cases for cryptography 


In the Security+ exam, "use case" just means examples of when something is used. We are 
now going to look at examples of when different cryptography techniques are used. 
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Supporting confidentiality 


A company's data cannot be priced, and the disclosure of this data could cause grave 
danger to the company. If your competitors stole your secrets, they could beat you to the 
market and you would not get the rewards that you deserved. To prevent data from being 
accessed, we will encrypt the data to prevent it from being viewed and prevent any 
protocol analyzer from reading the packets. When people access the company's network 
from a remote location, they should use a L2TP/IPSec VPN tunnel, using AES, as the 
encryption method to create a secure tunnel across the internet and to prevent man-in-the- 
middle attacks. Encryption could be coupled with mandatory access control to ensure that 
data is secure and kept confidential. 


Supporting integrity 

There are two main reasons for ensuring integrity. The first would be to hash data stored 
on a file server so that whether or not that the data has been tampered with can be proved. 
This could also be the case for a forensic examination of a laptop seized by the police—the 
forensic scientist could hash the data before the examination and then re-hash it at the end 
to prove that they had not tampered with the data. The hash values should match. 


Another method of proving integrity would be to digitally sign an email with your private 
key to prove to the recipient that it has not been tampered with in transit. Prior to this, you 
had to send them your public key to validate the email. This proves that the email has 
maintained its integrity and has not been tampered with in transit. 


Supporting non-repudiation 


When you digitally sign an email with your private key, you cannot deny that it was you, 
as there is only one private key; this is known as non-repudiation. When two separate 
parties decide to do a business deal together, they may use a third party to create a digital 
contract, but parties would log in to where the contract was stored—once they digitally 
sign it, then it is legally binding. 
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Supporting obfuscation 


When companies store their source code, they use obfuscation to make it obscure so that it 
cannot be read by anyone who steals it. This is also known as security by obscurity, where 
you want to prevent third parties knowing about your IT systems and identifying any 
weaknesses in the system. 


Low-power devices 


Small Internet of Things (IoT) devices will need to use ECC for encryption, as it uses a 
small key—they do not have the processing power for conventional encryption. 


Low latency 


When using encryption, we should use symmetric ciphers, such as 3DES or AES, to encrypt 
large amounts of data because they both use block cipher encryption with a small key 
length, compared to asymmetric keys, which have a minimum of 1,024 bits. The server will 
not have to use as much processing power, as the larger the key length is, the more 
processing and possible latency there can be. We should implement network accelerator 
cards where there is a lot of encryption and decryption. 


High resiliency 


We should be using the most secure encryption algorithm to prevent the encryption key 
from being cracked by attackers. The more secure the encryption key, the longer and more 
processing power it will take to gain the encryption key. In an RSA encryption 
environment, we should use a key with at least 3,072 bits. We should also look at 
implementing accelerator cards to reduce the amount of latency on the encryption or 
decryption. 


Supporting authentication 


A corporate environment should not use a single-factor username and password as they are 
not as secure as multifactor usernames and passwords. We should adopt at least two-factor 
authentication and use a smart card and PIN to make authentication more secure. Installing 
a RADIUS server adds an additional layer to authentication to ensure that authentication 
from the endpoints is more secure. 
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Resource versus security constraints 


The more secure the encryption used and the higher the key length, the more processing 
power and memory the server will need. If there are not enough resources on the server, it 
could be vulnerable to a resource exhaustion attack, which causes the systems to hang or 
even crash—it is like a denial-of-service attack. We must strike a balance between the 
hardware resources that the server has and the amount of processing power we use. 


Practical exercises 


For these three practical exercises, you need a 2012/2016 server that is a domain controller. 
If you are a home user and have access to a desktop with Windows 7, Windows 8.1, or 
Windows 10 and do not have a server, you can still complete the second exercise. 


Practical exercise 1 — building a certificate server 


1. Log in to your 2012/2016 domain controller and open Server Manager. 

2. Select Manage, then Add Roles and Features; click next three times. 

3. On the Select Server Roles page, check the top box, Active directory certificate 
server. Select the Add Features button. Click Next three times. Check the CA 
box, then click Next, and then Install. This will take a few minutes; when it is 
finished, press Close. 

4. On the Server Manager toolbar, double-click on the yellow triangle; this is a 
notification. In the post-deployment configuration wizard, double-click on the 
blue hyperlink, and click Configure active directory certificate service. Click 
Next, then in the role services wizard, check the CA box. You need to wait a few 
seconds, then the Next button comes alive. Press Next twice. In the CA Type 
wizard, select Root CA and click Next three times. For the CA name under 
Common name for this CA, enter the name MyCA, click Next three times, then 
click Configure. After it is configured, press Close. 

5. On the Server Manager toolbar, press Tools, then CA. Expand MyCA on the left- 
hand side, then expand Issued Certificates, which should be blank, as no 
certificates have been issued. See the following screenshot: 


[ 304 ] 


Implementing the Public Key Infrastructure Chapter 9 


il Certification Authority (Local) Request ID Requester Name Binary Certificate Certificate Termplate Serial Number 


4@i McA 
> Revoked Certificates 
_ Issued Certificates 
_) Pending Requests 
) Failed Requests 
_> Certificate Templates 


There are no items to show in this view. 


Figure 12: Certificate authority 


Practical exercise 2 — encrypting data with EFS 
and stealing certificates 


Follow these steps: 
. Go to the desktop; create a folder called test. 


. Inside the folder, create a text document called data. 
. Right-click the folder called data, then select Properties. 


BP WON 


. On the General tab, click Advanced, then check the box against encrypt content 
to secure data. The data folder should turn green; that means it is encrypted 
with EFS. 

5. Go to the Start button, then type mmc and select the icon with the red suitcase. 

6. Console 1 should open. Select File | Add remove snap in, then select 
Certificates, select Add, click Next, and then Finish. 

7. Expand Certificates | Current User | Personal. You should see an entry for an 
EFS certificate. 

8. Right-click the certificate. Select All tasks | Export. 

9. The certification export wizard appears. Press Next. On Export Private Key, 
select Yes, export the private key, and press Next. You will see that it is the P12 
format. Press Next, check the Password box, enter the password 123 twice, and 
then press Next. In the file to export, call it PrivKey and save it to the desktop. 
Press Next and then Finish. 

10. A box telling you the export was successful should appear. 

11. Repeat the exercise and export the public key as PubKey. 

12. You should notice the two files on the desktop; the public key has a .cer 

extension and looks like a certificate. The private has a . pfx extension and looks 

like a letter being inserted into an envelope. 
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Practical exercise 3 — revoking the EFS certificate 


1. 
pa 
3. 
4. 


Go to Server Manager | Tools and select Certificate Authority. 
Expand Issued Certificates and you should see an EFS certificate. 
Right-click the certificate and select All Tasks. 

Revoke the certificate. 


You will now notice it has moved from Issued Certificates to Revoked Certificates. 


Review questions 


. What type of certificate does a CA have? 
. If lam going to use a CA internally, what type of CA should I use? 
. If | want to carry out B2B activity with third-party companies or sell products on 


the web, what type of CA should I use? 


. Why would I make my CA offline when not in use? 

. Who builds the CA or intermediary authorities? 

. Who signs X509 certificates? 

. What can I use to prevent my CA being compromised and fraudulent certificates 


being issued? 


. If two entities want to set up a cross certification, what must they set up first? 
. What type of trust model does PGP use? 

. How can I tell whether my certificate is valid? 

. If the CRL is going slow, what should I implement? 

. Explain certificate stapling/OCSP stapling. 

. What is the process of obtaining a new certificate? 

. What is the purpose of the key escrow? 

. What is the purpose of the HSM? 

. What is the purpose of the DRA and what does it need to complete its role 


effectively? 


. How can I identify each certificate? 

. What format is a private certificate and what file extension does it have? 

. What format is a public certificate and what file extension does it have? 

. What format is a PEM certificate? 

. What type of certificate can be used on multiple servers in the same domain? 
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22. 
23. 


24. 
25. 
26. 
2h 
28. 
29. 


30. 
31. 


32. 


33. 
34. 


35. 
36. 
37. 
38. 


39. 
40. 
41. 
42. 
43. 
44. 


45. 


46. 


47. 
48. 


What type of certificate can be used on multiple domains? 

What should I do with my software to verify that is it original and not a fake 
copy? 

What is the purpose of extended validation of an X509? 

What type of cipher is the Caesar cipher and how does it work if it uses ROT 4? 
What is encryption and what are the inputs and outputs called? 

What type of encryption will be used to encrypt large amounts of data? 

What is the purpose of DH? 

What is the first stage in any encryption, no matter whether it is asymmetric or 
symmetric? 

If Carol is encrypting data to send to Bob, what key will they each use? 


If George encrypted data four years ago with an old CAC card, can he un- 
encrypt the data with his new CAC card? 


If Janet is digitally signing an email to send to John to prove that it has not been 
tampered with in transit, what key will they each use? 


What two things does digitally signing an email provide? 


What asymmetric encryption algorithm should I use to encrypt data ona 
smartphone? 


What shall I use to encrypt a military mobile telephone? 
Name two key-stretching algorithms. 
What is the purpose of key stretching? 


What is the difference between stream and block cipher modes, and which one 
will you use to encrypt large blocks of data? 


What happens with cipher block chaining if I don't have all of the blocks? 

If I want to ensure the integrity of data, what shall I use? Name two algorithms. 
If I want to ensure the protection of data, what shall I use? 

Is a hash a one-way or two-way function, and is it reversible? 

What type of man-in-the-middle attack is SSL 3.0 (CBC) vulnerable to? 


Explain why we would use Diffie Hellman Ephemeral (DHE) and Elliptic 
Curve Diffie Hellman Ephemeral (ECDHE). 


What are the strongest and weakest methods of encryption with an L2TP/IPSec 
VPN tunnel? 


What is the name of the key used to ensure the security of communication 
between a computer and a server or a computer to another computer? 


What should I do to protect data at rest on a laptop? 
What should I do to protect data-at-rest on a tablet or smartphone? 
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49. What should I do to protect data-at-rest on a backend server? 


50. What should I do to protect data-at-rest on a removable device, such as a USB 
flash drive or an external hard drive? 


51. What two protocols could we use to protect data in transit? 
52. How can you protect data in use? 

53. What is the purpose of obfuscation? 

54. What is the purpose of perfect forward secrecy? 

55. What type of attack tries to find two has values that match? 
56. What is the purpose of rainbow tables? 

57. Explain the concept of steganography. 

58. What are the two purposes of data loss protection? 

59. What is the purpose of salting a password? 
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Answers and explanations 


1. 
as 


3. 
4, 


A CA has a root certificate, which it uses to sign keys. 


I would use a private CA for internal use only; these certificates will not be 
accepted outside of your organization. 


I would use a public CA for B2B activities. 


If you were a military, security, or banking organization, you would keep the CA 
offline when it is not being used to prevent it from being compromised. 


. An architect would build the CA or intermediary authorities. 
. The CA would sign the X509 certificates. 
. Certificate pinning can be used to prevent a CA from being compromised and 


fraudulent certificates being issued. 


. If two separate PKI entities want to set up a cross certification, the root CAs 


would set up a trust model between themselves, known as a bridge trust model. 


. PGP uses a trust model known as a web of trust. 
. A Certificate Revocation List (CRL) is used to determine whether a certificate is 


valid. 


. If the CRL is going slow, an OCSP is used as it provides faster validation. 
. Certificate stapling/OCSP stapling is where a web server uses an OCSP for faster 


certificate authentication, bypassing the CRL. 


. A Certificate Signing Request (CSR) generates two keys; the public key is sent 


to the CA and then sent back the X509. 


. The key escrow stores and manages private keys for third parties. 
. A hardware security module is used by the key escrow as it securely stores and 


manages certificates. 


. When a user's private key becomes corrupt, the DRA recovers the data by 


obtaining a copy of the private key from the key escrow. 


. Each certificate can be identified by its OID, which is similar for each certificate. 

. A public certificate is in a P7B format witha .cer extension. 

. A private certificate is in a P12 format with a . pfx extension. 

. A PEM certificate is in Base64 format. 

. A wildcard certificate can be used on multiple servers in the same domain. 

. A Subject Alternative Name (SAN) certificate can be used on multiple domains. 
. Code-signing software is similar to hashing the software and ensuring the 


integrity of the software. 
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24. 


25. 


26. 
27: 
28. 


29. 


30. 


31. 


32. 


33. 
34. 


35. 
36. 
37. 


38. 


39. 
40. 


41. 
42. 
43. 


Extended validation is normally used by financial institutions as it provides a 
higher level of trust for the X509; when it is used, the URL background turns 
green. 


The Caesar cipher is a substitution cipher; an example would be ROT 4, where 
each letter would be substituted by a letter four characters along in the alphabet. 


Encryption is when plaintext is taken and turned into ciphertext. 
Symmetric encryption is used to encrypt large amounts of data as it uses one key. 


DH is an asymmetric technique that creates a secure tunnel; during a VPN 
connection, it is used during the IKE phase and uses UDP port 500 to create the 
VPN tunnel. 


The first stage in encryption is key exchange. During asymmetric encryption, 
each entity will give the other entity their public key. The private key is secure 
and never given away. 


Carol uses Bob's public key to encrypt the data and then Bob will use his private 

key to decrypt the data. Encryption and decryption are always done by the same 
key pair. 

George must obtain the old private key to decrypt the data as the encryption was 
done with a different key pair. 


Janet will digitally sign the email with her private key and John will check its 
validity with Janet's public key, which he would have received in advance. 


A digital signature provides both integrity and non-repudiation. 


ECC will be used to encrypt data on a smartphone as it is small and fast and uses 
the DH handshake. 


AES-256 will be used to encrypt a military mobile telephone. 
Two key-stretching algorithms are BCRYPT and PBKDF2. 


Key stretching salts the password being stored so that duplicate passwords are 
never stored, and it also increases the length of the keys to make things harder 
for a brute-force attack. 


Streams encrypt one bit at a time and block ciphers take blocks of data, such as 
128-bit modes. A block cipher will be used for large amount of data. 


CBC needs all of the clocks of data to decrypt the data, otherwise it will not work. 
Hashing ensures the integrity of data; two examples include SHA-1 (160 bit) and 
MD5 (128 bit). 

Encryption is used to protect data so that it cannot be reviewed or accessed. 

A hash is one-way and cannot be reversed. 

POODLE is a man-in-the-middle attack on a downgraded SSL 3.0 (CBC). 
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DHE and ECDHE are both ephemeral keys that are short-lived, one-time keys. 


The strongest encryption for an L2TP/IPSec VPN tunnel is AES and the weakest 
is DES. 


A session key ensures the security of communications between a computer and a 
server or a computer and another computer. 


Data-at-rest on a laptop is protected by FDE. 

Data-at-rest on a tablet or smartphone is protected by FDE. 

Data-at-rest on a backend server is stored on a database, so it needs database 
encryption. 

Data-at-rest on a USB flash drive or external hard drive is done via full disk 
encryption. 

Data-in-transit could be secured by using TLS, HTTPS, or an L2TP/IPsec tunnel. 
Data-in-use could be protected by full memory encryption. 

Obfuscation is used to make the source code look obscure so that if it is stolen, it 
cannot be understood. 

Perfect forward secrecy ensures that there is no link between the server's private 
key and the session key. If the VPN server's key was compromised, it could not 
decrypt the session. 

A collision attack tries to match two hash values to obtain a password. 

Rainbow tables are a list of precomputed words showing their hash value. You 
will get rainbow tables for MD5 and different rainbow tables for SHA-1. 
Steganography is used to conceal data; you can hide a file—image, video, or 
audio—inside another image, video, or audio file. 

DLP prevents sensitive or PII information from being emailed out of a company 
or being stolen from a file server using a USB device. 

Salting a password ensures that duplicate passwords are never stored and makes 
things more difficult for brute-force attacks by increasing the key size (key 
stretching). 
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10 


Responding to Security 
Incidents 


In this chapter, we will be looking at incident response, particularly with regard to the 
collection of volatile evidence for forensic analysis. 


We will cover the following exam objectives in this chapter: 


Using the appropriate software tools to assess the security posture of an 
organization, given a scenario: Coverage here will include protocol analyzers, 
network scanners, rogue system detection, network mapping, wireless 
scanners/crackers, password crackers, vulnerability scanners, configuration 
compliance scanners, exploitation frameworks, data sanitization tools, 
steganography tools, honeypot, backup utilities, banner grabbing, command-line 
tools, ping, netstat, tracert, nslookup/dig, ARP, ipconfig/ip/ifconfig, 
tcpdump, Nmap, and Netcat. 


Analyzing and interpreting the output from security technologies, given a 
certain scenario: Here we will cover HIDS/HIPS, antivirus, file integrity checks, 
host-based firewalls, application whitelisting, removable media control, 
advanced malware tools, patch management tools, UTM, DLP, data execution 
prevention, and web application firewalls. 

Following incident response procedures, given a certain scenario: We will look 
at response plans, documented incident types/category definitions, roles and 
responsibilities, reporting requirements/escalation, cyber incident response 
teams, exercises, the incident response process, preparation, identification, 
containment, eradication, recovery, and lessons learned. 
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e¢ Summarizing the basic concepts of forensics: This will involve the order of 
volatility, chain of custody, legal hold, data acquisition, capturing system images, 
network traffic and logs, capturing video, record time offset, taking hashes, 
screenshots, witness interviews, preservation, recovery, strategic 
intelligence/counterintelligence gathering, active logging, and tracking man 
hours. 


Explaining the concepts of disaster recovery and continuity of operations: Here 
we will look at backup concepts and full, differential, and incremental backups 
and snapshots. 


Incident response procedures 


There are many different incidents, and each of them requires a different incident response 
plan. For example, dealing with a flood is totally different to dealing with the failure of a 
server's hardware. The first stage of an incident response plan is to collect any volatile 
evidence so that the source of that incident can be identified, followed by containment of 
the incident itself, followed by the recovery procedures. Let's look in more detail at the 
components required to make incident response successful: 


¢ Documented incident types: We should already have documentation about each 
incident that shows the steps required for a positive response. These types of 
incidents are laid down under different category definitions. 


e Category definitions: Your company should have an outline of a plan for 
dealing with most incidents ranging from the following categories: 
e Unauthorized access 


e Loss of computers or data 

¢ Loss of availability 

e Malware attacks 

e DDoS attacks 

e Power failure 

e Natural disasters, such as floods, tornadoes, hurricanes, and fires 
e Cyber security incidents 
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e Roles and responsibilities: When an incident occurs, it is important to get an 
incident response team together to deal with the incident, which is made up of 
members in the following roles: 

e Incident response manager: A top-level manager who takes 
charge 


Security analyst: Technical support to the incident 


IT auditor: Checks that the company is compliant 

e Risk analyst: Evaluates all aspects of risk 

e HR: Sometime employees are involved in the incident 

e Legal: Gives advice and makes decisions on legal issues 


Public relations: Deals with the press to reduce the impact 


¢ Reporting requirements/escalation: Depending on the incident itself, you may 
have to report it to the authorities and/or your customer base should their credit 
card details be stolen. Your help desk must identify the incident response plan 
that deals with each particular incident so that it can be escalated to the team that 
has the skill set to deal with it. 


e Cyber incident response teams: Cybercrime is very prominent in today's world. 
It ranges from a single criminal trying to steal some money to organized criminal 
gangs through to advanced persistent threats, sometimes from national states. 
The cyber incident response team must move rapidly and have up-to-date 
training for the variety of incidents that they may face, and may have to use 
third-party specialists in some aspects of cybercrime. 


Incident response exercises: Companies will need to invoke each incident 
response plan periodically, very similar to fire drills that have been carried out 
for many years. This will allow your different incident response teams to gain the 
skill set necessary for dealing with future incidents. 


Incident response process 


While responding to an incident, the following processes are followed: 


1. Preparation: The preparation phase is where the different incident response 
plans are written and kept up to date. 

2. Identification: Once an incident has occurred, it is important that the 
appropriate incident response plan is invoked and the necessary personnel are 
notified. 
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3. Containment: When dealing with the incident, it is important that the volatile 
evidence is secured and the incident is prevented from spreading any further. 

4. Eradication: In the eradication phase, we want to destroy the source of the 
incident. For example, if it is a virus, we want it totally removed. 

5. Recovery: In the recovery phase, we are getting the company back to an 
operational state, hopefully within the RPO. For example, imaging machines and 
restoring data within one day. 

6. Lessons learned: Lessons learned is a detective phase where we pull together all 
of the facts and plan to prevent a re-occurrence in the future. Failure to carry this 
out will lead to a re-occurrence. The incident response process is shown here: 


Lessons Identificati 
Learned oe ngs 


Figure 1: Incident response process 
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Understanding the basic concepts of 


forensics 


Forensics is used by the police when they are investigating crimes and need to find as much 
evidence as they can to secure a conviction. We will be looking at computer- and web-based 
attacks. There are many different components, therefore we will look at each of them in 


turn: 


e Order of volatility: You are a firefighter and you arrive at a house on fire; you 
can only save items one at a time and there are two items inside. The first is a 
snowman, and the second is a rib of beef; you now have a dilemma: which one 
shall you choose? Easy! You save the snowman first as it is melting and you let 
the rib of beef cook some more so that the other firefighters can have a nice 
supper! So, when we want to ascertain the order of volatility, we are looking to 
secure the most perishable evidence first. We do not try and stop the attack until 
we have secured the volatile evidence so that the source can be identified. This is 
known as the order of volatility: 


Example 1 — web-based attack: An attacker is attacking the 
company website and the security team are trying to capture the 
network traffic to find the source of the attack. This is the most 
volatile evidence. 
Example 2 — attack inside a computer: When someone has 
attacked your computer, you need to capture the evidence in 
accordance with the order of volatility: 
e CPU cache: Fast block of volatile memory used by 
the CPU 
e¢ Random Access Memory (RAM): Volatile memory 
used to run applications 
¢ Swap/page file: Used for running applications when 
there is no RAM left 
e Hard drive: Data at rest for storing data 


Example 3—removable storage drive attached to a 
computer/server: Someone has left a USB flash drive plugged into 
your file server. When it is in use, programs such as Word are 
launched in RAM, so we would capture the volatile memory first. 
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e Example 4—command-line tools: You need to know which 
command-line tool provides information that could disappear if 
you reboot the computer, and that would be netstat. With netstat 
-an, netstat shows the listening and established ports. If you 
reboot the computer, all of the established connections will be lost. 


Exam tip 
The order of volatility is to do with collecting the most perishable 
evidence first. 


Five-minute practical 


Open up the Command Prompt on your computer and type netstat —an. You should 
now see the listening and established ports; count them, and write the numbers down. Run 
the shutdown /r /t 0 command to immediately reboot the machine. Log back in, go to 
the Command Prompt, and run netstat -an; what is the difference? You will see that you 
have lost information that could have been used as evidence: 


Volatile evidence summary 
Web-based attack Computer attack|Removable drive 


; CPU cache then |Volatile memory using 7 
Capture network traffic RAM RAM 


Exam tip 
Capturing network traffic is the first step in remote or web-based attacks 
so that you can identify the course of action to take. 
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e Chain of custody: The chain of custody starts when the evidence has been 
collected, bagged, and tagged. It lists the evidence and who has handled it along 
the way. For example, Sergeant Smith handed 15 kg of cocaine to Sergeant Jones 
following a drugs raid. However, when it is handed in to the property room, 1 kg 
is missing. In this event, we would need to investigate the chain of custody; in 
this scenario, Sergeant Jones would be liable for the loss. The chain of custody is 
shown here: 


August __ [Sergeant Smith SergeantJones___|15 kg cocaine 


14 kg cocaine 


e Example 1—missing entry on the chain of custody document: On 
Monday 15, laptops were collected by the system administrator. 
The next day, the system administrator passes them on to the IT 
manager. On Wednesday, the IT director presents the 15 laptops as 
evidence to the court. The judge looks at the chain of custody 
document and notices that there was no formal handover between 
the IT manager and the IT director. With the handover missing, the 
judge wants to investigate the chain of custody. 


Example 2—evidence leaves the detective's possession: The FBI 
arrest a known criminal and collect 43 hard drives that they bag 
and tag, before placing them in two bags. They arrest the criminal 
and take them from Arizona to New York. One detective is 
handcuffed to the criminal while the other carries the two bags. 
When they arrived at check-in, the airline clerk tells them that the 
carry-on bags are more than the 8-kg allowance, and therefore they 
are too heavy and need to go in the hold. The detective does this, 
but locks the suitcases to prevent theft. Because the evidence is not 
physically in their possession at all times, the chain of custody is 
broken as there is a chance for someone working for the airline to 
tamper with the evidence. Therefore, they cannot prove to the 
court that the integrity of the evidence has been kept intact at all 
times. 
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Exam tip 

The chain of custody must show who has handled the evidence until it is 
presented to the court. The evidence must not leave the possession of the 
person who has signed for it, otherwise it needs to be investigated. 


e Legal hold: Legal hold is the process of protecting any documents that can be 
used in evidence from being altered or destroyed. Sometimes, this is also known 
as litigation hold. 


Example: Dr. Death has been prescribing new drugs to patients in a large 
hospital who have been dying. An auditor has been sent to investigate the 
possibility of foul play, and then following the audit, the FBI are notified. 
The doctor has been emailing a pharmaceutical company that has been 
supplying the drugs for a trial. The FBI does not want the doctor to be 
alerted, so they have the hospital's IT team put his mailbox on legal hold. 
When the mailbox is on legal hold, the mailbox limit is lifted; the doctor can 
still send and receive email, but cannot delete anything. This way, they are 
not alerted to the fact that they are under investigation. 


e Data acquisition: This is the process of collecting all of the evidence from 
devices, such as USB flash drives, cameras, and computers; as well as data in 
paper format, such as letters and bank statements. The first step in data 
acquisition is to collect the volatile evidence so that it is secured. The data must 
be bagged and tagged, and included in the evidence log. 


Exam tip 
Recording the time offset is used for time normalization across multiple 
time zones. 


¢ Record time offset: When we collect evidence from computers, we should record 
the time offset. This is the regional time, so that in a multinational investigation 
we can put them into a time sequence—this is known as time normalization. 


Example: The police in three separate countries are trying to identify where 
the data started from in a chain, then who handled the data along the line. 
They have the following information of when it was first created: 


e New York: Created 3 a.m 
e London: Created 4 a.m 
e Berlin: Created 4.30 a.m 
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Without recording the time offset, it looks as if it started off in New York, but 
if we apply regional times, when it is 4 a.m. in London, the time in New York 
is 11 p.m. the day before, so it cannot be New York. When it is 4.30 a.m. in 
Berlin, it is only 3.30 a.m. in London; therefore, it originated in Berlin. 
However, with the record time offset, it looked the least unlikely before the 
time offset was applied. 


Forensic copies: If we are going to analyze removable data that we have 
acquired, we would first of all take a forensic copy and keep the original data 
intact. We would then use the copy to analyze the data so that we keep the 
original data unaltered, as it needs to be used in its original state and presented 
as evidence to the courts. 

Capturing system images: When the police are taking evidence from laptops and 
desktops, they take a complete system image. The original image is kept intact 
and the system is analyzed to find evidence of any criminal activity. 


Exam tip 
Taking a system image or a forensic copy of a hard drive is the first stage 
in any forensic investigation. 


Screenshots: You may also take screenshots of applications or viruses on the 
desktops and keep them as evidence. A better way of doing this would be to use 
a modern smartphone that would geotag the evidence. 

Taking hashes: When either the forensic copy or the system image is being 
analyzed, the data and applications are hashed at the beginning of the 
investigation. At the end, it is re-hashed and should match the original hash 
value to prove data integrity. If, during the investigation, the officer believes that 
they have made a mistake, they can re-hash the data; if it has been altered, they 
should note it down and then carry out the investigation as best they can. 


Exam tip 
Hashing data before and after the investigation can prove data integrity. 
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Network traffic and logs: When investigating a web-based or remote attack, we 
should first capture the volatile network traffic before stopping the attack. This 
will help us identify the source of the attack. In addition to this, we should look 
at different log files from the firewall, NIPS, NIDS, and any server involved. If 
we use a SIEM system, this can help collate these entries and give a good picture 
of any attack. 


Example: Your company uses an account lockout of three attempts. If an 
attacker tries to log in once to three separate computers, each computer 
would not identify it as an attack, as it is a single attempt on each computer, 
but an SIEM system would pick up these attempts as three failed login 
attempts and alert the administrators in real time. 


Capturing video: CCTV traffic can be a good source of evidence for helping to 
identify the attackers and the time the attack was launched. This can be vital in 
apprehending suspects. 

Witness statements: The police may also take witness statements to try and get a 
picture of who was involved and maybe then use photofits so that they can be 
apprehended. 

Preservation: Data needs to be preserved in its original state so that it can be 
produced as evidence in court. This is why we take copies and analyze the copies 
so that the original data is not altered and is pristine. Putting a copy of the most 
vital evidence in a Write-Once-Read-Many (WORM) drive will prevent any 
tampering with the evidence, as you cannot delete from a WORM drive. 
Recovery: When the incident has been eradicated, we may have to recover the 
data from a backup; a faster method would be a hot site that is already up and 
running with data less than one-hour old. We may also have to purchase 
additional hardware if the original hardware was damaged during the incident. 


Exam tip 
Re-imaging computers and restoring data is part of the recovery phase. 
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e Strategic intelligence/counterintelligence gathering: This is where different 
governments exchange data about cyber criminals so that they can work together 
to reduce threats. It is also possible for companies who have suffered an attack to 
log as much information as they can and have a third party who specializes in 
incident response to help them find a way to prevent re-occurrence. 


Active logging: To track incidents, we need to be actively monitoring and 
actively logging changes to patterns in our log files, or traffic patterns in our 
network. Installing an SIEM system can help collate all entries in the log files, 
ensuring that duplicate data is not used so that a true picture can be taken. Alerts 
based on certain triggers can be set up on our SIEM system so that we are 
notified as soon as the event happens. 


Tracking man hours: Companies should track man hours to realize the costs 
incurred during incidents. This may make them realize that they may have to 
spend more money on resources to protect against incidents. 


Software tools for assessing the security 
posture of an organization 


Security teams are constantly under attack from cyber criminals and threat actors, and they 

therefore need to be able to use a mixture of different security tools so that they can identify 
attacks before they have a chance to cause grave damage to the business. We will now look 

at each of these tools to see the benefits of each: 


e Protocol analyzer: A protocol analyzer, such as Wireshark, can capture the traffic 
flowing through the network, including passwords in clear text and any 
commands being sent to network-based applications. A protocol analyzer can 
identify the three-way handshake between two hosts and the verbs being used 
with applications, such as the HTML GET verb for fetching a web page. But if we 
see the PUT or HEAD verb, we could recognize this as an attack. 
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Example: Someone within the company is not working as they should be but 
has been surfing the web, and the manager has called you in as the security 
administrator to gather evidence. You decide that a protocol analyzer or 
packet sniffer is the best tool for tracking the information. You run a 
Wireshark session and capture visits to the NFL website. When you analyze 
the trace, you notice that the request is using the HTTP GET verb. This is the 
request for a page on www.nfl.com. When we drill down further into the 
analysis of the request, we are looking at a page with an article, Josh Hobbs 
and Mike Glennon drawing trade interest, as shown here: 


Case sensitive | Display filter >| {http 
Destination Protocol Length Info 


| 16329 38.806457 172.20.10.3 151.101.61.181 54 63685 > 8 [ACK] Seq=770 Ack=16894 Win=262144 Len=0 
| 16330 38.806731 151.101.61.181 172.20.10.3 1416 88 > 63685 [ACK] Seq=16894 Ack=770 Win=31344 Len=1362 [TCP segment of a reassembled PDU] 
| 16331 38.806733 «151.101.61.181 172.20.10.3 226 8@ > 63685 [PSH, ACK] Seq=18256 Ack=770 Win=31344 Len=172 [TCP segment of a reassembled PDU] 
| 16332 38.806734 —-151.101.61.181 172.20.10.3 1416 8@ + 63685 [ACK] Seq=18428 Ack=770 Win=31344 Len=1362 [TCP segment of a reassembled PDU] 
| 16333 38.806736 —«151.101.61.181 172.20.10.3 1416 8@ > 63685 [ACK] Seq=19790 Ack=770 Win=31344 Len=1362 [TCP segment of a reassembled PDU] 
| 16334 38.807079 —«172.20.10.3 151.101.61.181 54 63685 > 8 [ACK] Seq=770 Ack=21152 Win=262144 Len=0 
16335 38.838597 -151.101.62.2 172.20.10.3 66 80 > 63689 [SYN, ACK] Seq=@ Ack=1 Win=29200 Len=@ MSS=1362 SACK_PERM=1 WS=16 
| 16336 38.838600 «151. 101.62.2 172.20.10.3 66 80 > 63688 [SYN, ACK] Seq=@ Ack=1 Win=29200 Len=@ MSS=1362 SACK_PERM=1 WS=16 
16337 38.839203 —«172.20.10.3 151.101.62.2 54 63689 > 80 [ACK] Seq=l Ack=1 Win=262144 Len=@ 
| 16338 3.839565 172.20.10.3 151.101.62.2 54 63688 > 80 [ACK] Seq=1 Ack=1 Win=262144 Len=0 
} 16339 38.847809 ——172.20.10.3 151.101.62.2 1416 63689 > 8@ [ACK] Seq=1 Ack=1 Win=262144 Len=1362 [TCP segment of a reassembled PDU] 
16340 38.847899 _172.20.10.3 151,101.62.2 660 GET /nfl/trc/3/json?tim-@8%3A44%3A10. 581Rdata-%78%22id%22%3A140%2C%22i1422%3A%22%2F news*2Fstory%2Feap300000.. 
pate Seer Mi Wireshark - Packet 16340 - WiFi - a x 
| 16343 38.886451 
| 16344 38.886660 Type: IPv4 (0x@800) a 
Internet Protocol Version 4, Src: 172.20.10.3, Dst: 151.101.62.2 
Transmission Control Protocol, Src Port: 63689, Dst Port: 8, Seq: 1363, Ack: 1, Len: 66 
ena? 20 2n8eee [2 Reassembled TCP Segments (1968 bytes): #16339(1362), #16340(606)] 
Frame 16340: 660 byt | ~ 
¥ Ethernet II, Src: Li 
¥ destination: Geri Accept: application/javascript, */*}q=0.8\r\n 
Referer: http: //www.nfl.com/news/story/@ap3000000952209/article/josh-dobbs-mike-glennon-drawing-trade-interest\r\n 
= =| Accept-Language: en-GB\r\n 
[coe 6e 19 <0 59 db gl User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.@) like Gecko\r\n 
02 86 6F a3 : 4 
3 Accept-Encoding: gzip, deflate\r\n 
2| 
3) 
6 


Be @2 f8 c9 
@4 @@ ac 15 Host: Shi tabeola.com\rye 


2f 6e 65 77 7. 


3 
3@ 3@ 30 30 30 
60 69 63 6c 65 2 


Figure 2: Protocol analyzer 


Exam tip 
A protocol analyzer can detect the operating system of a host and 
commands being sent across the network to any applications. 


e Network scanners: A network scanner can be used to map out your network for 
you so that you can see the network devices and can also show performance data 
and packet loss; see the following screenshot: 
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Node Details - © bgep-2651-01- — Vital Stats 


Average Response Time & Network Latency & Packet Loss Top CPUs by Percent Load 


Packet Loss 


bap-2651.01 bgp-2651.01 


se = 


Average CPU Load & Memory 
Utilization — 


CPUs by Percent Load 


Mernory Used Min/Max/Average of Average CPU Load 


bap 2651.01 


Disk Volumes 


Top 5 Conversations (Endpoint 
Centric 


Figure 3: Network scanner 


e Rogue system detection: Rogue system protection tools, such as those made by 
McAfee, can detect rogue and unmanaged devices on your network and help you 
protect your network. If we also adopt 802.1x managed switches, we can prevent 
these devices from connecting to our network. 

e¢ Network mapping: A network mapper can show all the devices on your network 
along with their operating systems and the services running on them. These tools 
will be banned from use on a corporate network because of the vast amount of 
information that can be gathered. 
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e Wireless scanners: A wireless scanner is like a protocol analyzer for wireless 
networks. They can capture packets going to the wireless router. Embedded in 
the wireless packets is the name of the wireless network SSID. This means that 
even if you disable SSID broadcasting, the SSID can still be discovered. You 
could also use a SSID de-cloak device to find the SSID. 


Exam tip 
A network mapper can identify the operating systems and services 
running on a computer. 


Wireless crackers: Tools, such as Fern Wi-Fi Cracker, are written using the 
Python programming language and can be used to crack and recover the 
WEP/WPA and WPS keys. 

e Password crackers: Password crackers are tools that can perform the most 
common dictionary, brute-force, and rainbow table attacks. They can also use 
guessing, where they use words such as qwerty, password, and 12345; or 
spidering, where information about the company is used in passwords. This 
information can be found on the company's social media websites, such as 
Facebook and Twitter. This information can then be turned into words for 
password cracking. 

¢ Vulnerability scanner: There are two types of vulnerability scanner: 

¢ Credentialed: This basically involves running as an administrator 
and can find vulnerabilities and even audit files and permissions. 

¢ Non-credentialed: This is the most basic, running with limited 
permissions and scanning hosts to find missing patches. 


The vulnerability scanner is passive and does not cause damage to the systems. An example 
is Microsoft Baseline Analyzer (see the following screenshot). Although the computer was 
fully patched, as it was a credentialed scan, it gave me some information: 
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® Microsoft Baseline Security Analyzer 2.3 


Microsoft 


Baseline Security Analyzer 


Windows Scan Results 


Score Issue ~~ Result 


@ = Automatic The Automatic Updates feature has not been configured on this computer. Please upgrade to the latest 
Updates Service Pack to obtain the latest version of this feature and then use the Control Panel to configure 
Automatic Updates. 
What was scanned How to correct this 
oe Administrators More than 2 Administrators were found on this computer. 
What was scanned = Result details + How to correct this 
oo Password Some user accounts (4 of 5) have non-expiring passwords. 
Expiration What was scanned Result details How to correct this 
oe Incomplete No incomplete software update installations were found. 
Updates What was scanned 
oe Windows Windows Firewall is enabled and has exceptions configured. Windows Firewall is enabled on all network 
Firewall connections. 
What was scanned = Result details © How to correct this 
i] Local Account Some user accounts (3 of 5) have blank or simple passwords, or could not be analyzed. 
Password Test \Whatwasscanned Result details 
J File System All hard drives (2) are using the NTFS file system. 
What was scanned Result details 
9g Autologon Autologon is not configured on this computer. 


What was scanned 


& Print this report fe Copy to dipboard 


Figure 4: Credentialed vulnerability scan 


Exam tip 
A credentialed vulnerability scanner can audit files and examine 
permissions. 


¢ Configuration compliance scanner: Compliance scanning focuses on the 
configuration settings (or security hardening) being applied to a system in 
accordance with a compliance framework. This means we are ensuring that all of 
the settings of a system are configured properly. 

e Exploitation frameworks: Exploitation framework tools, such as the open source 
Metasploit Framework, can develop and execute exploit code against a remote 
target computer. This can be used to harden your IT systems before they are 
attacked. 
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e Data sanitization tools: When you delete data and then use the format 
command to reformat your hard drive, professional packages exist to recover the 
data (depending on how old the data is, as it deteriorates over time). Using 
professional data sanitization tools ensures that this data will never be recovered. 

e Steganography tools: Steganography tools can be used for encoding and 
decoding images, such as JPEGs, and audio files, such as WAV files. You can 
hide data inside all sorts of files, including audio, video, and image files. 


Exam tip 
A compliance scanner can ensure that all of the settings on computers are 
compliant and as they should be. 


e Honeypot: A honeypot is a website made to look like a legitimate website with 
lower security to distract attackers away from the legitimate website. 
Additionally, the security team can monitor the method that the attackers are 
using so that they can prevent such attacks in the future. 


Backup utilities 


Backing up data is very important, because if the systems fail, then a copy of the data can 
be obtained from a previous backup. A company cannot put a cost on its most critical data, 
and if it were to lose it, this would cause grave damage to the company (especially if the 
data was from the financial department or the research and development department, 
which makes new prototypes of products). 


There are various ways that we can back up the data: we can take snapshots of virtual 
machines, back up to a network, back up to tape, or back up to a removable device. Let's 
look at these in turn: 


e Creating a snapshot: When using virtualization, a snapshot can be created so 
that the virtual machine can be rolled back to a previous state. This is the fastest 
backup to recover from as it can be done in a matter of seconds. 
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e¢ Network location: A backup can be performed to a file share on a server in the 
network. The server would have some sort of RAID redundancy or the storage 
would be part of a SAN. 

¢ Backing up to tape: A backup can be backed up to magnetic tape, and this would 
be the slowest form of restore. Additionally, a copy of the backup tape can be 
stored offsite in case the company has a fire and burns down. 


Backup types 


There are various types of backups: full, incremental, and differential. Let's look at these in 
turn: 


e Full backup: A full backup is a backup of all of your data. However, some 
companies might only be able to back up all of their data over the weekend, so 
they will use either an incremental or differential backup in the middle of the 
week. 

Incremental: An incremental backup backs up the data since the last full backup 
or the last incremental backup. An incremental backup will need the full backup 
from the start and then all of the incremental backups. 

Differential: A differential backup will back up the data since the last full 
backup. The problem with this is if we have a full backup at the start of the week 
and then a differential backup every day, they will grow progressively larger 
each day. A differential backup will always be two tapes: the full backup from 
the start and the latest differential. 


Example: We will compare the different types of backup. We will start the 
backup every day, but will suffer data loss on the Friday, and we will see 
how many tapes we need to recover our data. Our full backup will be 50 GB 
of data, and every day, we will produce 5 GB of data. You can see this from 
the following table; how many tapes are needed for each type of backup to 
recover your data?: 


e Full: The latest full backup is 65 GB; every day, we back up more 
and more. 

e Incremental: Starts off with the full backup but needs all of the 
incremental backups. 
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e Differential: Starts off with the full backup but needs the latest 
differential backup: 


F 50 GB Mon 
Incremental (I) |F50 GBII5 GB |[5GB |I5 GB xf XL_ties: Wed, Thurs 
: ‘ F 50 GB Mon 
Differential (D)|/F 50 GB|D 5 GB |D 10 GB|D 15 ca 15 CB Thurs 


Exam tip 
a0 Symptoms of steganography include an image being lighter than it should 


be or a file being larger than it should be. 


e Banner grabbing: Banner grabbing is a technique used to gain information about 
a remote server and is often used as part of a fingerprinting attack. This could be 
where you are looking for details on remote systems such as a web server. If you 
are looking for the patch level of a web server, we would use banner grabbing to 
collect this information. 


Command-line tools 


Command-line tools are used every day by security professionals; therefore, for the 
Security + exam, you must be familiar with them, and so I have provided a screenshot for 
many of them. We are going to see when we would use each of them in turn: 


e Internet Control Message Protocol (ICMP): ICMP brings back the replies when 
you use command-line tools; therefore, if you block incoming ICMP on the 
network firewall, none of the tools will work externally. 

e Ping: Ping is used to test connectivity to another host. In the following 
screenshot, you can see that we have pinged the hostname, ianneil501.com, 
and we have received four replies. The Total Time to Live (TTL) is a maximum 
of 128 seconds; in this case, it is 47 seconds—see the following screenshot: 
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IINDOWS\system32>ping ianneil5@1.com 


Pinging ianneil5@1.com [4¢€ 
Reply from 46 
Reply from 46 
Reply from 46. 


Reply from 46. 


Jp a |e 
9.213.4 


ane 


WwW 


.45] with 32 
time=42ms 
time=44ms 
time=42ms 
time=43ms 


WW We 


NNN N 


Ping statistics for 46.30.213.45: 


Packets: 


linimum = 42ms, 


Sent 


4, 


Received = 4, Lost = @ 
pproximate round trip times in milli-seconds: 
Maximum = 44ms, Average 


Figure 5: Ping 


Chapter 10 


¢ Continuous ping: Continuous ping uses the ping -t command and is used for 
diagnostic testing. Normally, we run ping -t when we cannot connect and 
then, once we can connect, we will get replies—see the following screenshot: 


C: \WINDOWS\system32>pin 


s From 46 
y from 4 
, from 46 
, from 4 

from 46 
y from 4 
s from 46 
/ from 4 

from 46 
‘ from 4 

from 46 
y From 4 
y from 46 
, from 4 
) from 46 

from 4 


m Wm 
~~ [iis ~ Jin ~ i ~ Jie 


, from 46.3 


=P Bh 
“fale 
a7 I} 
oy [ee 
213.45 


ne 
o 


-t www.ianneil501.com 


a 


time=42ms TTL=47 
i 3ms TIL=47 
TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

TTL=47 

time=46ms TTL=47 


NNN 


WwW 


2 
2 
2 
2 
32 
32 
2 
2 


YW WwW Ww 


NNN 


Figure 6: Continuous ping 


.213.45] with 32 by 
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Tracing route to www.ianneil5e1. 


Chapter 10 


e Netstat: Netstat is used to see the established connections and the listening ports. 
If you reboot the computer, all of the established ports will disappear—see the 


following screenshot: 


C: \WINDOW 


yst 


em32>NETSTAT 


Active Connections 


Proto 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 
TCP 


Loc 


127.6.0. 


al 


127.8. 
127.@ 


127.0.0. 


127.0. 
127.0. 
127.€ 
127.€ 
192. 
192.168 
192. 
192.16 


® 


PRR RPP BP 


Foreign Address 
TOP-QR6R2DA 
TOP -QR6R2DA 
SKTOP-QR6R2DA 
KTOP-QR6R2DA 
KTOP-QR6R2DA: 
TOP-QR6R2DA: 
KTOP-QR6R2DA: 
TOP-QR6R2DA: 
4- 
H 
ams1@-604:http 
40.67.255.199: 


Figure 7: Netstat 


State 

ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
ESTABLISHED 
CLOSE | 

ESTABLISHED 
ESTABLISHED 
ESTABLISHED 


e Tracert: Tracert is used to trace the route between your computer and a target. 
This is at a maximum of 30 hops. If you have a reading of less than 2 ms, it is a 
great connection, but less than 25 ms is still a good connection. If you get a 
reading of over 800 ms, it means that you have poor connectivity; this could 
mean that a router is starting to fail—see the following screenshot: 


stem32>tracert www. 


over a maximum of 3@ hops: 


WW PWN eR 


a 


on 


<1 ms 
ms 


fea) 


Ww 
www 


VP PUP RPNMWNH 
nHh ha 


FPONWNNRP NY 


> 


tn 


= 
“x 


PPRPWNWN 
ONAna 


ianneil501.com 


com [46.3 


192.168. 


209.134 -62.static.virginmediabusiness.co.uk [62.31.134.209] 


timed out. 


re-2a-ae16-0.network.virginmedia.net [62.253.138.245] 


ldn-bi-1 : 

ldn-bb4-link.telia. (62.115. 
hbg-bb4-link. - (62.115. 
kbn-bb4-link. [213.155.1 
kbn-b3-link.telia.net [62.115.114 
one 307407-kbn-ho pilcot 


ae1-200.dr3-cph3.pub.network.one.com [4 
xe-@-2-@-200.ar1.pub.webpodi-cph3.one.com [46. 


webcluster46.webpodi-cph3.one.com [46. 


Figure 8: Tracert 


-213.4 
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Exam tip 
Netstat shows the established and listening port, but if you reboot the 


computer, the established connections disappear. 


¢ Nslookup: Nslookup is a diagnostic tool for verifying the IP address of a 
hostname in the DNS server database. We can also use the set 
type=MX command, which brings back the DNS details on all mail servers in the 
domain—see the following screenshot: 


Figure 9: Nslookup 


¢ Dig: Dig is the equivalent of nslookup in a Linux/Unix environment. As we can 
see in the following screenshot, the IP address of Google is 216.58.220.100: 


[root@centos7 ~]# dig google.com 


5 <<>> DiG 9.9.4-RedHat-9.9.4-29.e17_2.3 <<>> google.com 
global options: +cmd 
; Got answer: 
->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32702 
; flags: gr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: @, ADDITIONAL: 1 


; OPT PSEUDOSECTION: 
; EDNS: version: @, flags:; MBZ: @@@5 , udp: 4000 


53 QUESTION SECTION: 
; google.com. IN A 


53 ANSWER SECTION: 
google.com. 216.58.220.110 


55 Query time: 27 msec 

53 SERVER: 192.168.12.2#53(192.168.220.2) 
53 WHEN: Tue Sep 04 11:18:22 AEST 2018 

3; MSG SIZE rcvd: 55 


Figure 10: Dig 
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e Address Resolution Protocol (ARP): ARP is used to translate the IP address to a 
MAC address; the arp -a command shows the ARP cache. You can also use arp 
-s to add a static entry into the ARP cache—see the following screenshot. You 
could prevent ARP poisoning by using IPSec: 


Figure 11: ARP 


¢ ipconfig/ip/ifconfig: These commands show the IP configuration. The 
Windows version is ipconfig, but Unix/Linux can use ip or ifconfig. 


The ipconfig /displaydns command is run in the following screenshot, 
and it shows the DNS cache on a computer: 
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Figure 12: DNS cache 


ipconfig /flushdns is used to clear out all entries in the DNS cache—see 
the following screenshot: 


Figure 13: Clear DNS cache 
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¢ tcpdump: This is used by Linux/Unix as a packet sniffer command. 


tcpdump -i eth0 shows information on the first Ethernet adapter, as 
shown in the following screenshot: 


# tcpdump -i eth0 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 


listening on eth0O, link-type EN10MB (Ethernet), capture size 65535 bytes 


Wale 


33:31.976358 IP 172.16.25.126.ssh > 172.16.25.125.apwi-rxspooler: Flags [P.], seq 3500440357 


23500440553, ack 3652628334, win 18760, length 196 


ila te 


33:31.976603 IP 172.16.25.125.apwi-rxspooler > 172.16.25.126.ssh: Flags [.], ack 196, win 64 


487, length 0 


a be 
its 
ne 


4) 


ilake 
iil 


44) 


33:31.977243 ARP, Request who-has tecmint.com tell 172.16.25.126, length 28 
33:31.977359 ARP, Reply tecmint.com is-at 00:14:5e:67:26:1d (oui Unknown), length 46 
33:31.977367 IP 172.16.25.126.54807 > tecmint.com: 4240+ PTR? 125.25.16.172.in-addr.arpa. (4 


33:31.977599 IP tecmint.com > 172.16.25.126.54807: 4240 NXDomain 0/1/0 (121) 
33:31.977742 IP 172.16.25.126.44519 > tecmint.com: 40988+ PTR? 126.25.16.172.in-addr.arpa. ( 


11:33:32.028747 IP 172.16.20.33-.netbios-ns > 172.16.31.255-netbios-ns: NBT UDP PACKET({137): QUE 


RY; 


REQUEST; BROADCAST 


11:33:32.112045 IP 172.16.21.153-netbios-ns > 172.16.31.255.netbios—ns: NBT UDP PACKET(137): QU 
ERY; REQUEST; BROADCAST 


ane 


33:32.115606 IP 172.16.21.144-netbios-ns > 172.16.31.255.netbios—ns: NBT UDP PACKET(137): QU 


ERY; REQUEST; BROADCAST 


Figure 14: tepdump 


¢ Nmap: Nmap is a free and open source network mapper that can be used for 
network discovery and security auditing. Many systems and network 
administrators also find it useful for tasks, such as network inventory, managing 
service upgrade schedules, and monitoring host or service uptime. 

e Netcat: Netcat, or nc, is a utility for showing network connections in a 
Linux/Unix environment. The netcat -z command is being used to scan ports 
78-80, and from this you can see that ports 78 and 79 are closed, but port 80, 
being used by HTTP, is open. The -v switch means verbose and shows all 
information—see the following screenshot: 


$ netcat -z -v ianneil5@1.com 78-80 


nc: connect to ianneil5@1.com port 78 (tcp) failed: connection refused 
nc: connect to ianneil5@1.com port 79 (tcp) failed: connection refused 


Konnection to ianneil501.com port 8@ (tcp/html) succeeded! 


Figure 15: Netcat 
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Analyzing and interpreting output from security 
technologies 


There are various applications that security administrators can use to analyze and stop 
various attacks. Let's look at these here: 


e HIDS/HIPS: HIDS/HIPS are both used inside host computers; the HIDS is used 
to detect attacks and the HIPS is used to protect the computer against attacks. 
Both have filters set up to choose an alert type to filter. Look at the following 
screenshot, where we are setting a filter for insecure SSH connection attempts: 


To explore the alert data in more detail, you can choose an alert type on which to filter, as shown 
in the following two screenshots. 


Top 20 Alert Types 


@ SSH insecure connect... 


& 


field value Count 


SSH insecure connection attempt 7 


rule.comment.keyword (scan). (11.86%) 


Figure 16: HIDS output 
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e Antivirus/advanced malware tools: There are quite a few antivirus/anti-malware 
tools that will scan the computer on a regular basis and then produce reports. 
The following is a list of viruses that have been quarantined. The AVG free 
antivirus software has quarantined the four viruses so that they cannot cause any 
damage: 


@ QUARANTINE 


Threat 

Win32:Rootkit-gen... 
Win32:Rootkit-gen... 
Win32:Rootkit-gen... 


IDP.Generic 


Figure 17: Quarantined viruses 


The following screenshot shows a scan for vulnerable sensitive documents held on a 
desktop, and you can see that 135 documents have been found. We may need to install 
Data Loss Prevention (DLP) to protect these: 


135 vulnerable sensitive documents found 


Sensitive data in these documents is vulnerable to unauthorized ess 


Employment documents 27 documents 


Plane tickets 1 document 


Travel documents 1 document 


Other sensitive documents 


106 documents 


Figure 18: Sensitive documents scan 


e File integrity checker: Microsoft has a System File Checker (SFC) that can 
replace corrupted files by replacing them with a copy held in a compressed 
folder with system32. You runit with the sfc /scannow command, as shown 
in the following screenshot: 
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Figure 19: System file checker 


e File Checksum Integrity Verifier (FCIV): This is a Microsoft utility that can 
generate MD5 or SHA-1 hash values for files to compare values against a known 
good value. FCIV can compare hash values to make sure that the files have not 
been changed. This can help you identify changes that have been made to your 
computer system. 


¢ Host-based firewall: A host-based firewall can be used to prevent unauthorized 
access to the desktop, and we can set up allowed rules for those applications that 
we wish to use. The firewall in the following screenshot allows antivirus updates, 
checkpoints, VPN DNS name resolution, Firefox, and Java: 


@ Windows Defender Firewall witl Actions 


3 Inbound Rules 
I 
EZ Outbound Rules Name Profile Inbound Rules 


Six Connection Security Rules @ Antivirus Emergency Update Public & New Rule... 
> & Monitoring @ Antivirus Emergency Update Public v 
@ Check Point Endpoint Security VPN GUI All 
@ Check Point Endpoint Security VPN Service All 'Y Filter by State 
© DNS Server Forward Rule - TCP - 7538264... All Y Filter by Group 
@ DNS Server Forward Rule - UDP - 7538264... All 
@ Firefox (C:\Program Files\Mozilla Firefox) Private 
@ Firefox (C:\Program Files\Mozilla Firefox) Private 
@ Java(TM) Web Launcher Peake fs} Export List... 


Filter by Profile 


View 


| Refresh 


Figure 20: Host-based firewall 
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e Application whitelisting: Application whitelisting determines the rules on what 
applications are allowed to be run on a computer. The following is an example of 
application whitelisting using a Microsoft Application Control Policy tool called 
Applocker. This would then mean that the end user could only install and use 
these approved applications; if the application is not on the list, it is not allowed 
to be installed: 


Action 

@ Allow 
© Allow 
® Allow 


® Allow 
A Allow 
A Allow 


User 


Everyone 
Everyone 
Everyone 
Everyone 
Everyone 
Everyone 


Name Condition 
Microsoft Office 2016 Publisher 
McAfee Security Scan Publisher 
Mozilla Firefox Publisher 
Internet Explorer Publisher 
Wireshark Publisher 
Adobe Acrobat Pro Publisher 


Figure 21: Application whitelisting 


¢ Removable media control: Removable media are at a very high security risk as it 
is easy to steal data using them. However, we can prevent this by using a group 
policy; you can see one of the following options in the screenshot is Prevent 
installation of removable devices. This would prevent someone inserting a USB 
drive or another form of removable media to steal data: 


|=) Prevent installation of removable devices 


[=| Prevent Media Sharing 


[| Prevent restoring previous versions from backups 
(=) Prevent Windows Media DRM Internet Access 
(=) Prohibit connection to non-domain networks when connec... 


5) Provide the unique identifiers for your organization 


[| Removable Disks: Deny execute access 


[| Removable Disks: Deny read access 


(=) Removable Disks: Deny write access 


Figure 22: Removable media policies 


e Patch management tools: Microsoft has got a patch management tool called 
Windows Server Update Services (WSUS) that allows you to pull down the 
latest updates from the Microsoft website for different products. 
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Exam tip 
Applications must be added to the whitelist so that they can be approved 
to be used. 


¢ Unified Threat Management (UTM): UTM is a firewall that can also prevent 
URL filtering, content filtering, and malware inspection. The following 
screenshot shows the setting of the Sophos UTM firewall version 9, where you 
can see the various information that it provides: 


SOPHOS 


Dashboard for Thu Jul 3 2014 | 16-9914 


Dashdoard 


[# Resource usage Name Type 
Management (a 


cwOs 6% Al ptertaces 
RAM aS 2 internaiLan Ethernet 
ntertaces & Routing Log Disk = E 4% of 15808 emt SUN MGNT = EBemmat 


Pa mterface 
Network Services Data Dis! MMR2% of 12.0 68 eth2 WAN interface Ethernet DHCP 


wian2 Guest Wifi Etmernet 
Network Protection % utmsophos-exchange virtual © 


Wed Protection Modet: ASG Software [™ Advanced Threat Protection 


Defintions & Users 


E 

E 
‘ Current system abon 

Wiele’s Protector Network Protecton % y configur: 


Web Prot A 
Weoserver Protection inbacnie Pendle © Firewall active with 22 rules 
Wreiess Protecton @ intrusion Prevention s sctve with 6019 of 17861 patterns 
RED Management Endpomt AntiVirus o Web Filtering active, $7718 requests served today 
Ste-to-ste VPN Uptime: O¢ 18h 43m © Network Visibility 5 active 2 Appicaton Control rules actve 
© SMTP Proxy is active, 41 095 emails processed, 32 940 emails blocked 
© POPS Proxy is active. 10 290 emails processed, § 289 emails blocked 
Firewalt 101 674 packets fered © RED i active, 5 servers (0 oning), 0 clents (0 onine 
Support WPS: 195 attacks blocked © Vireless Protection s active, 0 APs connected 


Log off Antivirus: 5 tems blocked @ Endpoint Protection s active, Sophos LiveConnect @ enabled 0 endpomts 0 threat 


AntiSpam: 30 6S7 emais blocked alerts, 0 out-of-date alerts 
AntiSpyware: 7 tems biocked © Site-to-Site VPN is mactive 
Web Fitter: 408 URLs Mered © Remote Access # sctve with 0 onine users 
; ee SL REE © Wied Application Firewalls active, 412 314 requests served today 
8 devices blocked © Sophos UTM Manager & connected to SUM 
oO Sophos Mobile Control is active, with 0 of 0 devices non-compliant 
Version information © HACluster is nactve 


i<275 
vent raiannicesf ines Botneticommand-and control traffic detected 
Subscriptions: Base functonaity 
tect Emad Protection 


Remote Access B Today's threat status 


Logging & Reporting 


Figure 23: Sophos UTM 9 
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e Data Loss Prevention (DLP): DLP templates can be set up to prevent emails with 
sensitive and PII data from being emailed out of the company. DLP can prevent 
the removal of documents on a file server. 


Example: We wish to set up a template to prevent Visa, Mastercard, Diners 
Club, JCB, Discover, and American Express details from being emailed out. 
This is done by creating a template that consists of a regular expression. 
Should the pattern be matched, the email will be blocked and an 
administrator will be notified. The regular expression is shown here: 


4(?:4[@-9]{12}(?: [@-9]{3}) ?| [25] [1-7] [0-9] {14}|6(?:011|5 
[@-9][@-9]) [@-9]{12}|3[47][@-9]{13}|3(?:e[@-5]| [68] [e-9]) 


[@-9]{11}| (?:2131|1800|35\d{3})\d{11})$ 


Figure 24: Regular expression for credit cards 


e Data Execution Prevention (DEP): When DEP is enabled, it prevents harmful 
programs, such as viruses, and other threats from trying to execute in restricted 
areas of the operating system. From the Command Prompt, you can run the wmic 
OS GetDataExecutionPrevention_SupportPolicy command. The values 
will either be 0.1.2 and 3. The following screenshot shows that it has a value of 
2, which means it is enabled: 


Figure 25: Data execution prevention 


¢ Web Application Firewall (WAF): A WAF is used to prevent attacks on web 
servers and the applications that they host. The following screenshot is an 
example of the log file from a Sonic Wall web application firewall log: 
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Web Application Firewall > Log | Export Log IL Clear Log ] E-Mail Log |}® 


Search | 


in AllFields ~~ [Search ]| Exclude || Reset 


Items per page 100 Items 1 to 33 (of 33) 


Time V 


2013-02-01 08:29:21 Web Application Firewall 76.93.6. 176 10.203.23.180 dtelehowski 

2013-02-01 05:02:47 Web Application Firewall 95.143.243.150 10.203.23.180 tnaghmouchi 
2013-02-01 05:02:34 Web Application Firewall 95.143.243.150 10.203.23.180 tnaghmouchi 
2013-02-01 05:02:25 Web Application Firewall 95. 143.243.150 10.203.23.180 tnaghmouchi 
2013-02-01 05:02:07 Web Application Firewall 95.143.243.150 10.203.23.180 tnaghmouchi 
2013-02-01 05:01:42 Web Application Firewall 95.143,243.150 10.203.23.180 tnaghmouchi 


2013-02-01 04:59:43 Web Application Firewall 95.143.243.150 10.203.23.180 tnaghmouchi 


2013-02-01 04:59:39 Web Application Firewall 95.143.243.150 10.203.23.180 tnaghmouchi 


Priority Category Destination User Message 

WAF threat detected: Cookie Tampering (_mkto_trk) 
WAF threat detected: Cookie Tampering (_mkto_trk) 
WAF threat detected: Cookie Tampering (_mkto_trk) 
WAF threat detected: Cookie Tampering (_mkto_trk) 
WAF threat detected: Cookie Tampering (_mkto_trk) 
WAF threat detected: Cookie Tampering (_mkto_trk) 


WAF threat detected: Cookie Tampering (_mkto_trk) 


ocation 
a 
i 
| 
— 
— 
Lo 
— 
bax 


WAF threat detected: Cookie Tampering (_mkto_trk) 


Figure 26: WAF log file 


Review questions 


Noy Ole ON oe 


What is the purpose of an incident response plan? 

Name three different categories of incident. 

Name three different roles required to deal with an incident. 

What should the help desk do when an incident has just been reported? 

What is the purpose of an incident response exercise? 

What is the first phase of the incident response process and what happens there? 
What is the last phase of the incident response process? 


What would happen if the last process of the incident response process was not 
carried out? 


What is the order of volatility? 


. What is the first action you should take if your company experiences a web- 


based or remote attack? 


. What should you do if you find a USB flash drive in one of the servers? 
. What is the process of chain of custody and why would you investigate it? 
. What is the purpose of a legal hold? 


What is the purpose of record time offset? 


. What is the first stage a forensics officer should carry out when they have just 


taken possession of a laptop computer? 
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16. 


17. 


18. 
19. 
20. 
21. 
22. 


23. 


24. 
25. 


26. 


27. 


28. 
29. 
30. 
31. 
32. 
33. 
34. 


35. 


36. 


37. 
38. 


39. 


What is the first stage a forensics officer should carry out when they have just 
taken possession of a hard drive or removable drive? 


Why would a forensics officer take hashes of data before they start their 
investigation? 

What are the benefits of a security administrator using an SIEM system? 

Can I delete data that I have copies of on a WORM drive? 

Why would we carry out active monitoring? 

What tools can you use to find the operating system running on a computer? 
If you are using an unencrypted media package that runs across my network, 
how can you capture the passwords? 


If you want to find information about the operating system of a remote web 
server, what is the best tool to use? 


What is the purpose of a network mapper? 

If you have disabled the SSID on your wireless access point, can someone still 
find the SSID? 

What type of vulnerability scanner can audit files and find out account 
vulnerabilities? 

What is the most basic vulnerability scanner, which can only find missing 
patches? 

What tools can you use to ensure that the settings on your server are correct? 
What is the purpose of using the technique of steganography? 

How can you find the attack method a hacker would use to exploit your website? 
What is the quickest form of backup? 

What is the quickest form of tape backup? 

What are the most common types of backup? Name two. 

How many tapes would you need to recover your data if you use a differential 
backup? 

What would happen to command-line troubleshooting tools if you block 
incoming ICMP on the network firewall? 

What tool is used to test connectivity and what command would you use to 
make it continuous? 

What is normally the maximum value of a packet's TTL? 

What does the netstat -—an command-line tool provide and what would 
happen if you rebooted the computer? 


What tool can you use in a Windows environment to verify the hostname entry 
in the DNS server? 
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40. 


41. 
42. 
43. 


44. 
45. 


46. 


47. 


48. 


49. 
50. 


What are the commands for displaying the DNS cache and then clearing all 
entries from it? 


What command-line tool displays the route to a remote web server? 
What is a packet tracing tool used in a Linux/Unix environment? 


What is the command-line tool for showing the session between two hosts in a 
Linux/Unix environment? 


What is the purpose of a file integrity checker? 


If an application is neither on the blacklist or the whitelist, how can you ensure 
that you can install it on your computer? 


How could you prevent 4,000 people from installing USB flash drives on their 
computers? 

What tool is a firewall that can URL filter, content filter, and provide malware 
inspection? 

What tool can prevent PII and sensitive data from leaving your network via 
email or from being copied onto a USB flash drive? 

What is the tool that can prevent malicious programs from accessing the registry? 
What tool would you use to prevent an attack on a web-based application? 


[ 344 ] 


Responding to Security Incidents Chapter 10 


Answers and explanations 


1. 


2. 


3. 


11. 


An incident response plan is written for a particular incident and lays out how it 
should be tackled and the key personnel required. 


The different categories of incidents are as follows: 
e Unauthorized access 


e Loss of computers or data 
¢ Loss of availability 

e Malware attack 

DDoS attack 

e Power failure 


e Natural disasters, such as floods, tornadoes, hurricanes, and fires 
e Cyber security incidents 
The different roles required to deal with an incident are as follows: 
e Incident response manager—a top level manager takes charge 
e Security analyst—technical support to the incident 
e IT auditor—checks that the company is compliant 
e Risk analyst—evaluates all aspects of risk 
e HR—sometimes employees are involved in the incident 
e Legal— gives advice and makes decisions on legal issues 
e Public relations—deals with the press to reduce impact 


. The help desk identifies the incident response plan required and the key 


personnel that need to be notified. 


. An incident response exercise is for carrying out the incident response plan and 


planning for any shortfalls. 


. The first phase of the incident response process is the preparation phase, where 


the plan is already written in advance of any attack. 


. The last phase of the incident response process is lessons learned, where we 


review why the incident was successful. 


. If we do not carry out lessons learned, the incident may re-occur. Lessons learned 


is a detective control where we try to identify and address any weaknesses. 


. Collecting the most volatile evidence first. 
10. 


The first action would be to capture the network traffic so that we can identify 
the source of the attack. 


You should collect the data in the volatile memory first. 
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12. 


13. 


14. 
15. 
16. 
17. 
18. 


19. 
20. 
21. 


22. 


23. 


24. 


25. 


26. 


27. 


28. 


29. 


30. 


31. 
32. 


33. 


The chain of custody lists who has handled the evidence before it goes to court. 
Any break in the chain or the evidence leaving your site is a breach of the chain 
of custody and the judge would ask for it to be investigated. 


Legal hold is a process for ensuring the security of data so it cannot be deleted; 
one such measure would be putting someone's mailbox on hold. This is 
sometimes called litigation hold. 


Record time offset is used for time normalization across multiple time zones. 
They should take a system image so that it can be used for investigation. 

They should take a forensic copy so that it can be used for investigation. 

To ensure that when they are finished, they can prove the integrity of the data. 


An SIEM system can be used to correlate logs from multiple places and enable 
real-time reporting of incidents. 


Data cannot be deleted from a WORM drive, as it is write-once, read many. 
Active monitoring is used to identify an incident in real time. 


You can use a protocol analyzer to find the operating system running ona 
computer. 


You can use a protocol analyzer to capture the data and commands going to a 
network-based application. 


Banner grabbing is the best tool to use if you want to find information about the 
operating system of a remote web server. 


A network mapper can identify all hosts on your network, their patch level, and 
any services running on them. 


You can use a wireless packet sniffer or a SSID de-cloak device to find the SSID of 
your WAP, as it is embedded in the network traffic going to the WPA. 


A credentialed vulnerability scanner can audit files and find out account 
vulnerabilities. 


A non-credentialed vulnerability scanner can only find missing patches. 
A compliance scanner ensures that the settings on your server are correct. 
Steganography allows you to hide a file — be it an audio, video, or image file - 


inside another file (be it an audio, video, or image file). A larger file or a faded 
image are the tell-tale signs of steganography. 


You would set up a honeypot to find the attack method a hacker would use to 
exploit your website. 


The quickest form of backup is a snapshot of a virtual machine. 


The quickest form of tape backup is a full backup, as all backups need a full 
backup to start with. 


The two most common tape backups are full and incremental. 
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34. 
35. 


36. 


37. 
38. 


39. 


40. 


41. 


42. 
43. 
44. 


45. 


46. 


47. 


48. 


49. 


50. 


You would need two tapes to perform a differential backup. 


If incoming ICMP was blocked on the network firewall, none of your command- 
line tools would work as ICMP brings back the replies. 

Ping is the tool that is used to test connectivity, and the ping -t command is 
used for continuous ping. 

The normal maximum value of a packet's TTL is 128 seconds or less. 

netstat -an shows listening and established ports. If you reboot your 
computer, the established sessions will disappear. 


DNS lookup is used in a Windows environment to verify the hostname entry in 
the DNS server. Dig is the Unix/Linux equivalent. 

Ipconfig /displaydns displays the DNS cache and Ipconfig /flush clears 
all entries. 

Tracert is used to display the route to a remote web server over a maximum of 30 
hops. 

tcpdump is a packet tracer used in a Linux/Unix environment. 

Netcat or nc shows the session between two hosts in a Linux/Unix environment. 


A file integrity checker can determine whether a file has been altered by an 
application or is corrupt. 


If an application is neither on the blacklist or the whitelist, you need to add it to 
the whitelist so that you can install it on your computer. 


You can use a group policy to prevent 4,000 people from installing USB flash 
drives on their computers. 

A UTM is a firewall that can URL filter, content filter, and provide malware 
inspection. 

DLP can prevent PII and sensitive data from leaving your network via email or 
from being copied onto a USB flash drive. 


DEP can prevent malicious programs from accessing the registry by restricting 
the area that programs can access. 


A web application firewall can prevent an attack on a web-based application. 
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Managing Business Continuity 


In this chapter, we will be looking at our business environment to provide systems 
availability, selecting the most appropriate method for disaster recovery. This will be 
broken down into four distinct sections, and you must understand each of them: 


e Implementing secure systems design 

e The importance of the secure staging deployment concepts 

e Troubleshooting common security issues 

e Disaster recovery and the concepts of continuity of operations 
e Exam domain mapping 


We will cover the following topics in this chapter: 


e Troubleshooting common security issues, given a certain scenario: We'll cover 
unencrypted credentials/clear text, logs and events anomalies, permission issues, 
access violations, certificate issues, data exfiltration, misconfigured devices, 
firewalls, content filters, access points, weak security configurations, personnel 
issues, policy violation, insider threats, social engineering, social media, personal 
email, unauthorized software, baseline deviation, license compliance violation, 
availability/integrity, asset management, and authentication issues. 

¢ Implementing a secure systems design, given a certain scenario: We'll look at 
hardware/firmware security, FDE/SED, TPM, HSM, UEFI/BIOS, secure boot and 
attestation, supply chains, hardware root of trust, EMI/EMP, OSes, types, 
networks servers, workstations, appliances, kiosks, mobile OS, patch 
management, disabling unnecessary ports and services, least functionality, 
secure configurations, trusted OSes, application whitelisting/blacklisting, 
disabling default accounts/passwords, peripherals, wireless keyboards, wireless 
mice, displays, Wi-Fi-enabled MicroSD cards, printers/MFDs, external storage 
devices, and digital cameras. 
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e Explaining the importance of the secure staging deployment concepts: Here 
we'll get into sandboxing, environments, development, testing, staging, 
production, secure baselines, and integrity measurement. 

e Explaining disaster recovery and the continuity of operations concepts: We'll 
be covering recovery sites, hot sites, warm sites, cold sites, order of restoration, 
geographic considerations, off-site backups, distance, location selection, legal 
implications, data sovereignty, continuity of operations planning, 
exercises/tabletop, after-action reports, failover, alternative processing sites, and 
alternative business practices. 


Implementing secure systems design 


IT systems range from desktops and servers used internally within an organization, to 
mobile devices, such as laptops, that can be used externally in unsecured environments 
(such as hotels and airports). We therefore need to harden systems and OSes so that they 
are as secure as we can possibly make them. There are various aspects that we need to look 
at, depending on the functionality of the device and where it is used. Let's look at all of the 
aspects that we need to take into consideration, starting with a system booting up: 


e Basic Input Output System (BIOS): The BIOS on every computer is different, 
depending on the manufacturer, with the BIOS chip on the motherboard giving 
instructions on how the computer boots up. 

Unified Extensible Firmware Interface (UEFI): The UEFI is a modern version of 
the BIOS that is more secure and is needed for a secure boot of the operating 
system. 

Secure boot and attestation: Some newer OSes, such as Windows 10, can 
perform a secure boot at startup where the OS checks that all of the drivers have 
been signed—if they have not, the boot sequence fails. This can be coupled with 
attestation, where the integrity of the operation is also checked before booting 


up. 


Example: Your company is a multinational company that requires an OS that can be used 
by both desktops and laptops and can provide both secure booting and attestation. What 
OS and feature will you choose and why? At the moment, we are using a BIOS to boot up 
from. 
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The first thing that we would do is upgrade the BIOS to UEFI so that it can provide a secure 
boot. The OS selected would be Windows 10 as it provides secure booting, where the 
drivers need to be signed to allow booting. We would then enable Device Guard, which 
logs the setting of the OS and checks the integrity of the software and hardware, otherwise 
the boot sequence fails. 


Hardware/firmware security 


We need to protect our computer systems against someone stealing the data by stealing the 
device, re-installing the operating system, and stealing the data. We need to be able to 
secure the OSes and hardware by encrypting them using products such as Microsoft's 
Bitlocker. Let's look at some encryption methods: 


e Hardware root of trust: When we use certificates for FDE, they use a hardware 
root of trust that verifies that the keys match before the secure boot process takes 
place. 

Full Disk Encryption (FDE): FDE uses X509 certificates to encrypt the full disk, 
but needs a TPM chip on the motherboard to store the keys. Sometimes, these 
can be referred to as self-encrypting devices. When you boot up from the 
computer, you are asked for a password to access the system. 

Trusted Platform Module (TPM): The TPM chip is stored on the motherboard 
and is used to store the encryption keys so that when the system boots up, it can 
compare the keys and ensure that the system has not been tampered with. If the 
system thinks that tampering has happened, it locks itself up. The only way that 
it is accessed is by entering the recovery keys; for example, with Bitlocker, it is a 
48-character password. 

Hardware Security Module (HSM): An HSM is similar to TPM chips except that 
it is removable. The key escrow uses an HSM to store and manage private keys, 
but smaller ones can be used for computers. 


Exam tip 
EB FDE needs either a TPM chip on the motherboard or an HSM. 
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e Supply chain: It is vital that you have vetting for your supply chain as those in 
your supply chain may be given limited access to your network and may be able 
to install hardware into your network. You need to ensure that the people 
working for them have been cleared and the systems that they put in place have 
a certain level of security. You also need to ensure that the company doesn't have 
a bad credit rating and can always supply the hardware and services, even if a 
disaster occurs. 


Electromagnetic Interference (EMI): EMI coming from motors, fluorescent 
lights, and radio frequencies could affect a system's performance and could cause 
jamming and prevent IT systems from working. 

Electromagnetic Pulse (EMP): An EMP is a strong burst of electric energy that 
can damage electronic systems; an electrostatic discharge can cause permanent 
damage. Other forms include military weapons that can cause nuclear 
explosions, and lightning strikes. Surge protectors, uninterruptible power 
supplies, shielding, and Faraday cages can be used to protect against EMPs. 


Operating systems 


There are various OSes, such as Linux, that are used by the cloud and many network 
appliances, and Microsoft has Windows 10 for desktops and laptops, and Server 29016 for 
servers. There is also Android for many phones, as well as Apple's iOS for iPhones and 
iPads. Let's look at the different uses of these: 


e Networks: Network devices such as switches, routers, and firewalls all have 
some sort of OS installed so that they can be configured. Normally, these are 
different versions of Linux, such as FreeBSD, Red Hat, CentOS, and Ubuntu. 

e Servers: A server OS needs to be secure as these can be used for databases, such 
as SQL Server, or a mail server, such as Exchange Server 2016. The domain 
controller runs on OSes such as Windows Server 2016 and has a secure boot. 

e Workstations: Workstation OSes, such as Windows 10, are the most secure client 
OSes. Windows 10 has a secure boot and has the ability to use Bitlocker, a version 
of FDE for protecting against data theft. 

e Appliances: Security appliances include firewalls and intrusion detection 
systems; intrusion detection systems are used to protect against attacks. 
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e Kiosk: A kiosk is a computer in a reception area or foyer; it is used to gain access 
to the building that you are visiting. Their functionality is limited and they 
would normally be a workgroup and not connected to the network. 


Trusted operating system: A trusted operating system is a secure system, 
normally used by the military, that has multiple layers of security, as it is used to 
access classified data. It is tied down tightly and changes to the OS are highly 
controlled. 

Mobile OS: Apple's iOS is an OS for Apple's mobile devices, such as the iPhone 
and the iPad, and Android is used by other mobile telephones, such as those 
produced by Samsung. 


Securing IT systems 


It is important that we secure all of our IT systems against attacks. Let's now look at ways 
of hardening the OS to reduce the surface attack: 


e Disable default accounts/passwords: The first step when we receive an IT 
system or an IoT device would be to disable the default administrative accounts 
and then reset the default passwords to prevent unauthorized access to the 
system. 


Disabling unnecessary ports and services (principle of least functionality): A 
secure system should only have the minimum number of services enabled and 
should have a secure firewall to block all ports, with the exception of those 
required for the applications running on them. The secure system should have 
only the functionality required for business purposes. It should not have any 
applications running except those that are authorized to do so. 


Exam tip 
When administering a new IT system or IoT device, you need to change 
the default administrator account and password. 


Secure configurations: The military uses a STIG that outlines what setting 
should be enabled or disabled for a military system. Another cause to secure the 
configuration of an OS is for compliance reasons, and periodically, you can use a 
compliance scanner to ensure that the configuration is still secure. 
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Application whitelisting/blacklisting: Application whitelisting involves a list of 
approved applications that can be installed onto an IT system. The application 
blacklist is a list of named applications that are forbidden. The most common 
reason why someone cannot run an application on an IT system is that it has not 
been added to the whitelist and not the fact that it is on the blacklist. 

Patch management: Patch management is where updates are downloaded and 
tested on an isolated system, such as in sandboxing, and when they have been 
thoroughly tested, they are then rolled out to the IT systems. This ensures that 
the IT systems have no vulnerabilities. 


Peripherals 


Now we have looked at the security of the IT systems, we need to look at the vulnerabilities 
of the peripherals to see where they are vulnerable: 


Wireless keyboards/wireless mice: Wireless keyboards/wireless mice should not 
be used on secure systems as they are not encrypted and could easily be 
intercepted by a wireless packet sniffer. 

Displays: We need to ensure that we use display filters and do not have displays 
facing external windows. This is to prevent shoulder surfing. 

Wi-Fi-enabled MicroSD cards: Wi-Fi-enabled MicroSD cards have the same 
vulnerabilities as wireless keyboards and mice, where data can be intercepted by 
a wireless packet sniffer. 

Printers/Multifunction Devices (MFDs): Printers/MFDs are very vulnerable. For 
example, a printer may have data in the spooler waiting to be printed off and a 
scanner may have an image stored in its internal memory. 

External storage device: External storage devices normally operate with a USB 
interface and therefore are easy to steal data from. The best way to protect 
against data theft would be to use Bitlocker-to-go, which encrypts the whole 
drive, or use a self-encrypting device. 

Digital cameras: Digital cameras store information on memory cards that are 
very easy to remove from the camera. They may have pictures of documents that 
could be printed off very easily. 
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The importance of the secure staging 
deployment concepts 


Before applications can be used in a production environment, we must ensure that they are 
as secure as possible to mitigate the risk of being attacked by an outside agency. We are 
going to look at three different aspects: sandboxing, environment, and secure baseline. Let's 
look at these in turn: 


e Sandboxing: Sandboxing is where we can install an application in a virtual 
machine environment isolated from our network so that we can patch, test, and 
ensure that it is secure before putting it into a production environment. Ina 
Linux environment, this is known as Chroot Jail. 

e Environment: When we are designing an application, we need a secure staging 
environment for development, testing, and staging before moving the application 
into production. Such an environment is shown in the following diagram: 


Development 


Staging 


Figure 1: Environment 


Development: The first stage of developing an application is 
where the application developer looks to use the most secure 
programming language for the task at hand. The application will 
go through different versions before it is complete, and these can 
be tracked by using version numbers. 

Testing: Software testers ensure that the functionality of the 
program fulfills the specifications. They may also employ a secure 
coding freelancer to carry out regression testing to ensure that the 
application is fit for production. At this stage, we are not looking at 
how it affects the production environment, as this is completed at 
staging. 
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e Staging: Staging is the process of rolling out the application to 
simulate a production environment; an end user will be asked to 
use the application to ensure that the data output is correct before 
the application is rolled out to the production environment. Those 
supporting the application will have training on the application so 
that they can support it when it is rolled out to production. 


Production: The production environment is where the application 
goes live and end users have the support of the IT team. The end 
users will be asked to give as much feedback as they can should 
the application have any problems that were not picked up 
beforehand. 


e Secure baseline/integrity: A secure baseline is a list of applications, the 
configurations of the applications, and the patches of the applications that 
improves the security posture of the IT systems. We can use vulnerability 
scanners to identify any changes that might affect the integrity of the systems. 
A File Checksum Integrity Verifier (FCIV) and a System File Checker (SFC) 
can identify changes in the integrity of the application. 


Troubleshooting common security issues 


On a day-to-day basis, the security team will come across some of the following issues; we 
will look at how the team can mitigate them: 


e Unencrypted credentials/clear text: Unencrypted credentials/clear text are a 
security risk as they can be intercepted by a packet sniffer or protocol analyzer. 
We should be using an authentication protocol, such as Kerberos, that is 
encrypted and encrypts data in transit. 

e Logs and events anomalies: There are many logs in a company (such as firewall 
logs, antivirus logs, and event viewers on computers and servers), showing 
attempts to log into the network. The best way to prevent duplications of events 
and get real-time monitoring would be to install an SIEM system. 


e Permission issues: Permissions that are incorrectly set can give users more 
permissions than they need to do their jobs, but someone with more permissions 
will not let anyone know that this is the case. Audit user accounts and 
permissions on a regular basis to identify this. 

e Access violations: Access violations are where users are accessing data that they 
are not allowed to see; for example, someone may have access to the payroll file 
and can see the salaries of everyone in the company. Audit user accounts and 
permissions on a regular basis to identify this. 
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¢ Certificate issues: When a new certificate is not working, we should first of all 
ensure that the certificate is valid and then check that it has been added to the 
Trusted Root Certification Authorities folder so that the computers trust the 
certificate provider—see the following screenshot: 
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Figure 2: Trusted Root Certification Authorities 


e Data exfiltration: Data exfiltration can be carried out by steganography, and the 
way to prevent this would be to use a stateful firewall to deeply inspect the data 
passing through it. Files becoming larger and images becoming lighter are 
symptoms of steganography at work. We can also prevent someone from stealing 
data via email or by putting it on an external device; this would be by using Data 
Loss Prevention (DLP). 


Exam tip 
If a certificate does not work, ensure that it is valid and add it to the 
Trusted Root Certification Authorities folder. 


e Asset management: One of the problems a company could face is the loss or 
theft of assets. The first stage would be to create an asset register and have all 
asset devices tagged. We could use cable locks for desktops, laptops, and tablets. 
We could use mobile device management to remotely wipe stolen data and RFID 
to stop small devices leaving the company. We could use geotracking on the 
mobile devices so that devices can be found. 
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Authentication issues: One of the most common authentication issues facing a 
security team is passwords, where people either forget their password or input 
the password with the caps lock on and then try it three times and get locked out. 
Also, as it is a single factor, it is no longer secure enough on its own. Another 
method would be using biometrics, but even then, the biometric device could 
suffer from FAR and FRR. One of the best solutions to this would be to use two- 
factor authentication using smart cards and certificates, as this would cause the 
lowest amount of support calls. 


Misconfigured devices 


It is vital that all network appliances are properly configured, else the company could be 
vulnerable to attack. Let's look at some of the appliances for this: 


Firewalls: The purpose of a firewall is to prevent unauthorized access to the 
network, and it is vital that no one employee is responsible for maintaining the 
rules. When new rules are added, a second member of the IT team should 
confirm that the rule is correct. 

Content filters: If the UTM or proxy server has the incorrect content filter set up, 
then employees may be able to access gaming sites while at work, which would 
then reduce the productivity of the workforce. 

Access points: If the wireless access point was not set up properly, then it could 
mean that people would be able to access the company network from outside the 
building. The wireless access point should be set up using WPA2-CCMP 
encryption coupled with the disabling of the SSID and the enabling of MAC 
filtering. 

Weak security configurations: In general, if we set up IT systems with a weak 
security configuration, then we are leaving the company open to attack. We 
should ensure that none of the systems use the default username and password 
and that we use a compliance scanner to ensure that the system is set up as 
securely as it can be. 
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Personnel issues 


Most cybercrime is successful due to the actions of people that work for the company, and 
therefore we need to set up policies to mitigate against any attack. Let's look at some of the 
personnel security issues facing the security team: 


¢ Policy violation: Companies write policies so that all employees know what is 
expected of them so that risks can be mitigated. During the induction period, the 
HR team has the new personnel read and sign the company policies. For 
example, if Iam going to use my email account, there will be an email policy to 
guide me; or, if 1am a remote user, I am expected to use a VPN to gain remote 
access to the company. Company employees should be reminded that failure to 
comply with company policies will be seen as a policy violation and could lead 
to disciplinary action and even being dismissed. 

Insider threat: The insider threat is the hardest threat to stop, as the insider may 
use someone else's credentials. You could install CCTV in all offices so that when 
the attack is carried out, you can see who is using the source computer at that 
time. 


Exam tip 
Accessing the company network externally with a secure connection or 
VPN is a policy violation. 


Social engineering: The most common social engineering attacks that affect a 
business are tailgating and familiarity. We need to give users annual training, 
reminding them about the dangers of tailgating; and no matter how friendly 
reception staff get with other employees, they should be aware of familiarity, 
where people will try and access areas that they are not allowed to get into by 
exploiting relationships. The security team could give each person a smart card 
that could be used with a smart card access control system. 

Social media: Data that is posted on social media can be used in social 
engineering attacks, and such data can sometimes be used to try and crack 
passwords. Annual security awareness training should warn employees of the 
danger of posting information about the company. 

Personal email: We can use DLP templates to prevent sensitive and PII 
information from leaving the company by email, but we cannot control use of 
personal email accounts, such as Gmail or Hotmail accounts. The security team 
should use either UTM or a proxy, and block the URLs of personal email 
providers. 
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Software issues 


Software is no longer run locally, as some of it is now run or downloaded from the internet. 
Therefore, the security team needs to be aware of unauthorized software being installed on 
their IT systems. Let's look at some software issues: 


Unauthorized software: One symptom of someone using unauthorized software 
is that the internet bandwidth is increasing while the disk space on the IT system 
is reducing. One of the best ways to stop this from happening it to use an 
application whitelist, where only approved applications can be installed. 


Exam tip 
Someone downloading unauthorized software will increase the 
bandwidth and reduce the disk space. 


Baseline deviation: When we roll out an image to desktops, we know that they 
have the same baseline, but we need to ensure that we run a baseline visualizer 
tool that can detect changes to the original baseline. We could also use a manual 
method of baseline comparison on a regular basis. 


License compliance violation: The company purchases 10 licenses for an 
application and then installs it onto the approved desktops. When another 
member of the company manages to steal the license key and puts it in their 
desktop, the company has violated the license agreement and the company could 
face a regulatory fine. We could prevent this violation by installing the software 
on a share and limiting the number of people using the share to equal the 
number of licenses that we have purchased. Another license violation would be 
someone installing a cracked copy of software on a company's desktop. We could 
prevent the installation of unauthorized applications by implementing 
application whitelists. 
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Disaster recovery and the continuity of 
operations concepts 


It is important that if a company suffers from a disaster, they can be up and running as 
soon as possible. Disasters range from natural disasters, such as hurricanes and floods, to 
hardware failure, malicious insider attacks, and accidental deletion of data. The main aim 
of a disaster recovery plan is getting the company back up and running so that it can 
generate income. Let's look at the different aspects of disaster recovery: 


e Business Impact Analysis (BIA): A BIA looks at the monetary loss if a company 
is not up and running, coupled with the purchase of new equipment so that the 
business can continue to operate. 

e Recovery sites: There are three main types of recovery site: these are hot, cold, 
and warm sites. Let's look at each of them: 

¢ Hot site: This site is up and running with staff loading data into 
live systems on an hourly basis. This makes it the most expensive 

to maintain, but it has the fastest recovery. We may also use a 

cloud provider to host our hot site, as it would allow us to be back 

up and running immediately. 

Warm site: A warm site is similar to a hot site but data is backed 

up on a daily basis, so it will take a little bit longer to get up and 

running than a hot site. 

Cold site: A cold site is the cheapest to maintain as it has power 

and water but no staff or equipment, making this the slowest site 

to get up and running. 


e Order of restoration: Once a disaster has happened, it is important that we look 
at the services necessary for getting a company back up and running. We would 
rank them as critical, essential, or non-essential, and we would work on getting 
the most crucial service up and running first. However, if you are restoring from 
a differential or incremental backup, you would have to restore the full backup 
first before the differential and incremental tapes. 


Exam tip 
Cloud providers and multinational companies can only store data within 
the region that it was created in. 
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Geographic considerations: Where your data is located has a major impact on 
the restoration phase following a disaster, so this impact must be accounted for. 
We will look at distance, off-site backups, and location selection: 

e Distance: We know that the fastest site to restore is a hot site, but if 
the hot site is 200 miles away, think of the logistics in getting 
company personnel to that site. This may take a few days to 
organize. 

Location selection: The location of the hot site is critical to how 
fast we can recover our data and systems. If it is very far away and 
if one region suffers a power failure or is hit by a hurricane, can we 
get the site back up and running? This is why the cloud would be a 
good choice. 


Off-site backups: When we back up our data, we should be 
storing backup tapes in a fire-proof safe and keeping our latest 
copy off-site, in case we suffer from a natural disaster. 


Data sovereignty: Data that has been created and turned into digital data is 
subject to the laws and regulations of the company that created it. It cannot be 
moved to another region—even for a backup-related reason. This affects both 
cloud providers and multinational corporations, as they cannot simply move 
data where they want to. 


Legal implications: Digital data is subject to the laws and regulations of the 
company in which it is created. The company creating the data must be 
compliant; for example, they may need to hold medical data for 25 years, 
financial data for 5 years, and normal data for 2 years. 


Continuity of operations planning: Companies need to look at each type of 
disaster and put processes in place for the company to be back up and running as 
quickly as possible. For example, your hot site could be in the cloud or you may 
have two different sites, and when the disaster happens, you would failover to 
the other site, keeping the business running. 


Disaster recovery exercises: There are two types of exercises that you can carry 
out to ensure that your company is ready for any disaster; these are structured 
walkthroughs and tabletop exercises. Let's look at both of these: 
e Tabletop exercise: A tabletop exercise is paper-based, where all 
parties meet around a table and discuss how they would deal with 
a disaster scenario. 
e Structured walkthrough: A structured walkthrough is where a 
mock disaster is enacted physically with all parties involved 
(similar to a fire drill). 
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e After-action reports: Once a company has suffered a disaster, the management of 
the company needs to review all of the information so that they can reduce the 
impact or prevent the disaster from re-occurring—this is known as lessons 
learned. 


Failover: Failover can be measured in two different ways. You may set up 
servers in a cluster, where the passive server will take over when the active 
server fails. Another method of failover is where the company has two or more 
different sites, so that when one site fails, the other site takes over and keeps the 
business functioning. 


Alternate processing sites: There are two main alternate processing sites that 
you could use following a disaster. You could use a mobile site or you could use 
a cloud provider to provide the infrastructure that you need. 


Alternate business practices: You may adopt an alternate business practice to 
ensure that you can keep the business going, or you may need to purchase 
services from another company. 


Exam tip 

If we don't hold a post-incident meeting, then we will not prevent the 
incident from re-occurring. This vital stage of learning these lessons, 
funnily enough, is known as lessons learned. 


Review questions 


1. What type of BIOS needs to be implemented if we want an operating system to 
be able to securely boot? 


2. When a Windows 10 OS securely boots, what checks does it carry out relating to 
drivers? 


3. What type of trust model is being used if we use FDE? 


4. If my laptop is going to use FDE, what type of chip do I need to have installed on 
the motherboard? 


. Why would you need to vet your supply chain? 

. Where does EMI come from and how can it affect your computer systems? 
. What is the difference between EMI and an EMP? 

. What can a company install to reduce the threat of an EMP? 


‘Oo CON OD Ol 


. What is the purpose of a kiosk? 
10. Describe a trusted OS. 
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11. 
12. 


13. 
14. 
15. 
16. 
17. 


18. 
19. 
20. 


21. 
22. 
23. 


24. 
25. 


26. 


Zh 
28. 
29. 
30. 


31. 


32. 
33. 
34. 


35. 


Name two mobile OSes and where they are used. 

When we receive a new IT system or IoT device, what is the first step we need to 
carry out? 

Why would you disable unnecessary ports and services? 

What is the purpose of using STIG? 

How can I protect an external storage device against data theft? 

What should I do to reduce the attack surface on a digital camera? 


What is the best way to test a bespoke application before moving it into 
production? 


What are the four stages when designing a new application? 
What is an example of access violation? 


If I purchase a new X509 certificate and it does not work, what two actions 
should I carry out? 


How can I tell whether someone is stealing data using steganography? 
What can we do to prevent someone stealing PII or sensitive data? 
What is the most common authentication method that can be incorrectly 
configured? 

How can we prevent someone from stealing a laptop or a tablet? 


If a remote user is accessing the company's network externally and decides not to 
use a VPN, what are they guilty of? 


What information should I not post on social media platforms, such as Twitter or 
Facebook? 


What are two symptoms that someone is downloading unauthorized software? 
Give an example of license compliance violation. 

What is the best site for quick disaster recovery? 

If my company is a multinational corporation, can I store New York data in 
London, in case the New York site falls over? 

If my hot site is over 200 miles away, what should I consider to make recovery 
much faster? 


What is a theory-based or paper-based disaster recovery exercise called? 
What is the purpose of an after-action report? 


What is the cheapest but slowest site to get back up and running during disaster 
recovery? 


What is the difference between geotracking and geotagging? 
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Answers and explanations 


1. 


(ee) 


10. 


11. 


12. 


13. 


14. 


15. 
16. 


17. 


You would implement the Unified Extensible Firmware Interface (UEFI), as it is 
more secure and has the ability to securely boot an OS. 


. When a Windows 10 OS securely boots, it checks that all of the drivers are 


digitally signed. 


. A hardware root of trust is used by FDE. 
. FDE needs a TPM chip on the motherboard or a portable HSM. 
. You need to vet people working for companies in your supply chain and also 


ensure that can sufficiently supply goods and services. 


. EMI coming from motors, fluorescent lights, and radio frequencies affects a 


system's performance and could prevent IT systems from working properly. 


. EMI interferes with IT systems, but an EMP destroys them. 
. Acompany installs a UPS or surge protector to reduce the threat of EMPs. 
. Akiosk is a computer in a reception area or foyer that needs to be tied down so 


that only information about the building is available. 

A trusted OS is a secure system, normally used by the military, that has multiple 
layers of security as it is used to access classified data. It is tied down tightly and 
changes to the OS are controlled. 

Apple's iOS is an OS for Apple's mobile devices, such as the iPhone and the iPad, 
and Android is used by other mobile telephones, such as those produced by 
Samsung. 

The first step to take when we receive a new IT system or IoT device is changing 
the default administrator username and password. 

You disable unnecessary ports and services to harden the OS and reduce the 
attack surface. 

A Security Technical Implementation Guides (STIG) is used by the military to 
ensure that OSes are tied down tightly. 

You should use FDE to protect an external storage device against data theft. 

You should remove the memory card to reduce the attack surface on a digital 
camera. 

You should use sandboxing to test a bespoke application before moving it into 
production. 
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18. 


19. 


20. 


21. 
22. 
23. 


24. 
25. 
26. 
Die 


28. 


29. 
30. 
31. 
32. 
33. 


34. 


35. 


The four stages when designing a new application are developing, testing, 
staging, and production. 


Access violation is where a user is accesses data that they should not be able to 
see. 


You would first of all check that the certificate is valid and then check whether it 
has been added to the Trusted Root Certification Authorities folder. 


A file would be larger and an image would be lighter in color. 
We can use DLP to prevent someone stealing PII or sensitive data. 


The most common authentication method that can be incorrectly configured is a 
username and password. 


We can use cable locks to prevent someone from stealing a laptop or a tablet. 
They are guilty of policy violation. 
Company information should never be posted on social media. 


Your internet bandwidth has increased and your local disk space has been 
reduced. 


License compliance violation is where you steal the license to an application and 
then install it on your desktop without consent. 


The fastest disaster recovery site is the hot site. 

No, data can only be stored regionally; you would need a backup site in the USA. 
You should consider moving your hot site to the cloud. 

A tabletop exercise is a theory-based or paper-based disaster recovery exercise. 
An after-action report looks at how an incident happened and what measures to 
put in place to prevent re-occurrence; it is sometimes known as lessons learned. 
The cheapest disaster recovery site is the cold site; it is the slowest to get back up 
and running as it has power and water and nothing else. 

Geotracking can tell you the location of a mobile device and geotagging puts the 
location and time of capture on a picture. 
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1. What type of attack is a Padding Oracle On Downgrading Legacy Encryption 
attack? Choose two options from the following list: 


A. IV attack 

B. Replay attack 

C. Man-in-the-middle attack 

D. TLS 1.0 with electronic code book 
E. SSL 3.0 with chain block cipher 


2. You are the security administrator for the British secret service. What type of 
access method will you use for secret and top-secret data? 


A. You will use DAC, with the owner of the data giving the access 
B. You will use DAC, with the custodian of the data giving access 
C. You will use DAC, with the security administrator giving access 


D. You will use MAC, with the security administrator giving access 
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3. Your company wants to encrypt DNS traffic by using DNSSEC. Once you have 
signed the zone, what records are created for each host? 


A. CNAME 
B. AAAA 
C. RRSIG 
D. Mx 

E. PTR 


4. You are a security administrator. A user called Ben is having a discussion with 
one of his colleagues. They have four choices for two-factor authentication. They 
have asked for your advice as to which of the following is a two-factor 
authentication method. Select the best answer: 


A. Smart card 

B. Password and PIN 

C. Passphrase and username 
D. Retina and fingerprint scan 


5. Two separate CAs need to work together on a joint venture. What can they 
implement so that certificates can be used for cross certification? 


A. Bridge trust model 
B. Certificate pinning 
C. Certificate stapling 


D. Wildcard certificates 
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6. John goes to a sports website and gets the following error: 


THIS WEBSITE CANNOT BE TRUSTED. 


What two actions does the website administrator need to take to resolve this 
error? 


A. Ask the key escrow to store their private key 

B. Ensure that the website uses a valid SAN certificate 

C. Update the root certificate in the client computer certificate store 
D. Verify that the certificate on the server has not expired 


7. A security administrator discovers that an attacker used a compromised host as a 
platform for launching attacks deeper in a company's network. What 
terminology best describes the use of the compromised host? 


A. Brute force 

B. Active reconnaissance 
C. Pivoting 

D. Passing point 


8. Mary is managing the company's wireless network, which uses WPA2-PSK. 
What kind of encryption is most likely to be used? 


A. SHA-1 
B. AES 
C. MD5 
D. DES 
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9. 


10. 


11. 


Who is responsible for setting permissions when using a mandatory access 
control (MAC) model? 


A. Owner 

B. Manager 

C. Administrator 
D. User 


Company A is due to upgrade all of its IT systems, and has been investigating 
the possibility of moving to the cloud, as there is no capital expenditure because 
the CSP provides the hardware. Company A would still like to control the IT 
systems in the cloud. Which cloud model would best serve company A's needs? 


A. Software as a Service (SaaS) 
B. Infrastructure as a Service (IaaS) 
C. Monitoring as a Service (MaaS) 
D. Platform as a Service (PaaS) 


You are the security administrator and the IT director has tasked you with 
collecting the volatile memory on Server 1, as it is currently experiencing a 
cyberattack. Which of the following are the two best forms of volatile memory to 
collect? 


A. Secure boot 

B. Swap/page file 
C. USB flash drive 
D. ROM 

E. RAM 
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12. 


13. 


14. 


15. 


Bill and Ben are going to encrypt data using asymmetric encryption, which uses 
public and private keys. What is the first step they need to take? 


A. Exchange public keys 

B. Exchange private keys 

C. Exchange digital signatures 
D. Exchange telephone numbers 


At what stage in the SDLC are computer systems no longer supported by the 
original vendor? 


A. Sandboxing 

B. End-of-life systems 
C. Resource exhaustion 
D. System sprawl 


Company A has just developed a bespoke system for booking airline tickets. 
What is it called if a freelance coding specialist tests it for security flaws? 


A. Code review 

B. Static code review 

C. Regression testing 

D. Dynamic code review 


You are the security administrator for a company that has just replaced two file 
servers, and you have been tasked with the disposal of the hard drives that are 
used to store top-secret data. What is the best solution? 


A. Hashing 
B. Degaussing 
C. Low-level formatting 


D. Shredding 
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16. You are the security administrator for an airline company whose systems 
suffered a loss of availability last month. Which of the following attacks would 
most likely affect the availability of your IT systems? 


A. Spear phishing 

B. Replay 

C. Man-in-the-middle (MITM) 
C. DoS 


17. You are a network administrator setting up an L2TP/IPSec VPN tunnel, as your 
company needs to move a large amount of encrypted data between a branch 
office and the head office. Why is Diffie Hellman used for an IKE phase before 
the data is forwarded via symmetric encryption? 


A. It is a symmetric encryption technique that protects keys 
B. It is a hashing technique that protects keys 
C It is an ephemeral technique that protects keys 


D. It is an asymmetric technique that protects keys by setting up a secure 
channel 


18. You are a lecturer at a college and you need to deliver a session on salting 
passwords. What are the two main reasons you would salt passwords? 


A. To prevent brute force attacks 
B. To make access to the password slower 
C. To prevent duplicate passwords being stored 


D. To stop simple passwords from being used 
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19. 


20. 


21. 


Which of the following methods of authentication are known as two-factor 
authentication? 


A. PIN and passphrase 

B. Mastercard and PIN 

C. Username and password 

D. Retina and facial recognition 


During a forensic investigation, the judge decrees that any data that is 
investigated should remain in its original form of integrity. Which of the 
following are used for the integrity of data? Choose two from the following list: 


A. MD5 
B. AES 
C.SHA 1 
D. DES 


Company A has suffered a distributed denial-of-service attack and the company 
has decided that their RPO should be set at four hours. The directors are holding 
a board meeting to discuss the progress that is being made. During the meeting, 
the IT manager mentions the RTO, and the CEO looks confused. How can you 
explain the meaning of the RTO to the CEO? 


A. Acceptable downtime 
B. Return to operational state 
C. Measure of reliability 


D. Average time to repair 
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22. The following is a list of different controls. Which of these are physical security 
controls? 


A. Change management 
B. Antivirus software 

C. Cable locks 

D. Firewall rules 

F. Iris scanner 


23. The security team has identified an unknown vulnerability and isolated it. What 
technique is the best to use to investigate and test it? 


A. Steganography 
B. Fuzzing 

C. Sandboxing 

D. Containerization 


24. What is it called when a user has exploited an IT system so that they have 
obtained access to all files on the file server? 


A. Remote exploit 

B. Zero-day exploit 

C. Privilege escalation 
D. Pivoting 


25. You are the security administrator for your company, and the IT manager has 
asked you to brief him on XML authentication methods. Which of the following 
should you tell him uses XML-based authentication? Select all that apply: 


A. TOTP 
B. Federation services 


C. Smart card 
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D. SSO 
E. SOAP 
F. SAML 


26. There is a group of certificates in a folder, and you need to identify which 
certificate uses the Privacy Enhanced Mail (PEM) format. Which of the following 
is the best choice to make? 


A. PFX 
B. CER 
C. BASE 64 
D. P12 


27. Three different companies want to develop an application for which they will 
share the cost of developing resources and future running costs. Which cloud 
model best describes this? 


A. Public cloud 
B. Software as a Service (SaaS) 
C. Private cloud 
D. Platform as a Service (PaaS) 
E. Infrastructure as a Service (IaaS) 
F. Community cloud 
28. What type of keys does a key escrow manage? 
A. Public 
B. Session 
C. Shared 


D. Private 
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29. Which of the following is an email-based attack on every member of the sales 
team? 


A. Phishing 

B. Vishing 

C. Spear phishing 
D. Pharming 


30. An attacker tried to target a high-level executive, but, unfortunately, had to leave 
a voicemail as the executive did not answer the telephone. What was the 
intended attack and what attack will eventually be used? Select all that apply 
from the following list: 


A. Whaling 

B. Vishing 

C. Phishing 

D. Spear phishing 


31. An auditor has been investigating the theft of money from a charity. He has 
discovered that the finance assistant has been embezzling money, as the finance 
assistant was the only person who dealt with finances, receiving donations and 
paying all of the bills. Which of the following is the best option for the auditor to 
recommend to reduce the risk of this happening again? 


A. Hashing 

B. Job rotation 

C. Separation of duties 
D. Mandatory vacations 


E. Encryption 
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32. 


33. 


34. 


You are a security administrator and you have moved departments. You are now 
working with the certificate authority and training Mary, who is a new intern. 
Mary has asked you what the certificate object identifier (OID) consists of. What 
should you tell her? 


A. Certificate-signing request 
B. Certificate pinning 

C. Certificate stapling 

D. Certificate serial number 


You are the operational manager for a multinational corporation, and you are 
writing a policy in which you mention the RPO. Which of the following is the 
closest to the definition of an RPO? 


A. Acceptable downtime 

B. Return to operational state 

C. A measure of system reliability 
D. Average time to repair 


You are carrying out annual training for your company and need to put a 
PowerPoint slide together on the symptoms of a backdoor virus. Which three 
points should you include in the slide? Each provides part of the explanation of a 
backdoor virus: 


A. Programs will not open at all, even though you are clicking many times 
B. You must click on several items 

C. They can be included in an email attachment 

D. Files open quicker than before 


E. Your system can only get infected through a link on a web page 
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35. 


36. 


You are a security administrator and need to set up a new wireless access point 
so that it is not backward compatible with legacy systems, as these may be 
vulnerable to attack, and it must be the strongest encryption that you can use. 
Which is the best solution to meet your needs? 


A. WPA2 PSK 
B. WPA TKIP 

C. WPA2 TKIP 
D. WPA2 CCMP 


Which of the following commands can be used to create a buffer overflow? 
Choose all that apply: 


A. var char 
B. strcpy 
C.var data 


D. strcat 


37. James has raised a ticket with the IT help desk; he has been tampering with the 


settings on his computer and he can no longer access the internet. The helpdesk 
technicians have checked the configuration on his desktop and the settings are 
the same as everyone else's. Suddenly, three other people have also reported that 
they cannot connect to the internet either. Which network device should be 
checked first? 


A. Switch 
B. Router 
C. Hub 


D. Repeater 
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38. Which of the following is a secure wireless protocol that uses TLS? 
A. NTLM 
B. PAP 
C. EAP 
D. AES 


39. You are the security administrator for a multinational corporation, and the 
development team has asked your advice as to how to best prevent SQL- 
injection, integer-overflow, and buffer-overflow attacks. Which of the following 
should you advise them to use? 


A. Input validation 

B. A host-based firewall with advanced security 
C. Strepy 

D. Hashing 


40. Your company is opening up a new data center in Galway, Ireland, where you 
have installed the server farm, and now a construction company has come in to 
put a six-foot mantrap in the entrance. What are the two main reasons for this 
mantrap being installed? 


A. To prevent theft 

B. To prevent tailgating 

C. To prevent unauthorized personnel gaining access to the data center 
D. To allow faster access to the facility 


41. Which of the following devices can prevent unauthorized access to a network 
and prevent attacks from unknown sources? 


A. Router 

B. Load balancer 

C. Web security gateway 
D. UTM 
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42. The Internet of Things (IoT) is a concept that has recently taken off. Which of the 
following devices fall under this category? Select all that apply: 


A. ATM 

B. Banking system 

C. Smart TV 

D. Refrigerator 

E. Router 

F. Wearable technology 


43. Which DNS feature helps to balance a load without needing to install a network 
load balancer, and, when coupled with a load balancer, makes it more dynamic? 


A. DNS CNAME 
B. DNSSEC 
C. DNS round robin 
D. DNS SRV records 
44. What is the benefit of certificate pinning? 
A. It prevents a certificate-signing request from a non-administrator 


B. It is used by a web server, and it bypasses the CRL for faster 
authentication 


C. It stops people from spoofing, issuing certificates, or compromising your 


D. It is used for cross certification between two separate root CAs 


45. An auditor has just finished a risk assessment of the company, and they have 
recommended that we mitigate some of our risks. Which of the following are 
examples of risk mitigation? Select all that apply: 


A. Turning off host-based firewalls on laptops 


B. Installing antivirus software on a new laptop 
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C. Insuring your car against fire and theft 
D. Outsourcing your IT to another company 
E. Deciding not to jump into the Grand Canyon 


46. A security engineer wants to implement a site-to-site VPN that will require SSL 
certificates for mutual authentication. Which of the following will you choose? 


A. L2TP/IPSec 
B. SSL VPN 

C. PPTP VPN 
D. IKEv2 VPN 


47. You are the Active Directory administrator and you have been training new 
interns on the Kerberos ticket-granting ticket session. One of the interns has asked 
about the relationship between a service ticket and session ticket used by 
Kerberos authentication. Which of the following is the best description for this? 


A. The user exchanges their service ticket with the server's session ticket for 
mutual authentication and single sign-on 


B. The service key is unencrypted and is matched with the value in the 
session ticket 


C. The user shows the server his session ticket; and the server sends him a 
service ticket 


D. The user shows the server his service ticket; and the server sends him a 
session ticket to keep 


48. Your company has a guest wireless network that can be used by visitors during 
the day, sales staff during the evening, and customer-service staff at lunchtime. 


They set up a captive portal that fulfills the following criteria: 


e Guests do not need to authenticate 
e Sales staff do not need to insert any credentials 
e Customer-service staff must use the highest level of encryption 
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How will you set up your captive portal? Select three answers from the following 
list, where each answer provides part of the solution: 


A. WEP 40 bit key 

B. WPA2 TKIP 

C. WPA-TKIP 

D. Open-system authentication 
E. WPA2 CCMP 

F. WPS 


49. You are a security administrator, and the IT team has been using RSA for the 
encryption of all its data, but has found that it is very slow. Which of the 
following should the security administrator recommend to improve the speed of 
the encryption? 


A. Asymmetric encryption using DES 

B. Asymmetric encryption using Diffie-Hellman 

C. Symmetric encryption 

D. Running a vulnerability scan to find a better solution 


50. Robert, who is an intern, has been assigned to the security team. A user has 
called him to ask who signs the X509 certificates. Which one of the following 
should Robert give as an answer? 


A. CRL 

B. Key escrow 
CeCSR 

D.CA 
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1. You are the security administrator for a large multinational corporation, and you 
have used a black box penetration tester to find vulnerabilities in your company 
and exploit them as far you can. During the penetration test, it was found that 
there were some vulnerabilities in your Windows 10 desktop operating system. 
There were no vulnerabilities in any of your Linux or Unix systems. Which of the 
following reasons best describes why the penetration tester was successful with 
the Windows 10 machines, but not with the Linux or Unix machines? 


A. Linux and Unix are more secure than Windows 10. 

B. The penetration tester did not attempt to exploit the Linux/Unix machines. 
C. The Linux and Unix operating systems never have any vulnerabilities. 

D. The operating systems' attack vectors are very different. 


2. You are a security administrator and you wish to implement an encrypted 
method of authentication for your wireless network. Which of the following 
protocols is the most secure for your wireless network? 


A. PAP 

B. WPA2-PSK 
C. EAP-TLS 
D. PEAP 
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3. You are designing the network topology for a new company that is rapidly 
expanding from a one-premises company with 20 users to a medium-sized 
company with 300 users. The company tells you that it was subjected to a DDoS 
attack last year that took the company down for over a day. In your network 
design, they don't want to implement a DMZ; therefore, traffic will be coming 
directly from the internet. How do you propose to best mitigate against future 
DDoS attacks? Select two answers from the following list; each is part of the 
solution: 


A. Install a stateless firewall at the edge of your network to prevent incoming 
traffic. 


B. Install a stateful firewall at the edge of your network to prevent incoming 
traffic. 


C. Install a NIDS on your network as an additional layer of protection. 
D. Install a NIPS on your network as an additional layer of protection. 
E. Install an inline NIPS on your network as an additional layer of protection. 


4. You work on the cyber security team of a large multinational corporation, and 
you have been alerted to an attack on the web server inside your DMZ that is 
used for selling your products on the internet. You can see by running net stat 
that you have an unknown active connection. What should be the first step you 
take when investigating this incident? 


A. Isolate the web server by disconnecting it from the network to prevent 
further damage. 


B. Disconnect all external active connections to ensure that any attack is 
stopped. 


C. Run a packet sniffer to capture the network traffic to identify the attacker. 


D. Take a screenshot of the damage done to the website and report the 
incident to the police. 
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5. Ineed to purchase a certificate that I can install on five mail servers. Which one 
should I purchase? 


A. PEM certificate 

B. Wildcard certificate 

C. Subject Alternative Name (SAN) certificate 
D. Root certificate 


6. You are the manager of a large IT company and it is your duty to authorize the 
administrative controls. Which of the following are actions that you would 
normally authorize? Select all that apply: 


A. Collecting an ID badge 

B. Creating an IT security policy 
C. Purchasing a cable lock 

D. Creating a new firewall rule 


7. You are the operational manager for a financial company that has just suffered a 
disaster. Which of the following sites will you choose to be fully operational in 
the smallest amount of time? 


A. Cold site 
B. Warm site 
C. Hot site 


D. Campus site 
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8. 


10. 


The serious crimes agency has just taken control of a laptop belonging to a well- 
known criminal that they have been trying to track down for the last 20 years. 
They want to ensure that everything is done by the book and no errors are made. 
What is the first step in their forensic investigation, prior to starting the chain of 
custody? 


A. Making a system image of the laptop 
B. Placing it in a polythene bag and sealing it 
C. Hashing the data so that data integrity is assured 


D. Asking for proof of ownership of the laptop 


. If an attacker is looking for information about the software versions that you use 


on your network, which of the following tools could he/she use? Select all that 
apply: 


A. Protocol analyzer 
B. Port scanning 

C. Network mapper 
D. Baseline analyzer 


Footage of people relaxing in their homes started appearing on the internet 
without the knowledge of the people being filmed. The people being filmed were 
warned by relatives and coworkers, resulting in an enquiry being launched by 
the police. Initial evidence reported a similarity in that they had all recently 
purchased IoT devices, such as health monitors, baby monitors, smart TVs, and 
refrigerators. Which of the following best describes why the attacks were 
successful? 


A. The devices’ default configurations were not changed. 
B. Their houses had been broken into and hidden cameras were installed. 


C. Their wireless networks were broadcasting beyond the boundaries of their 
homes. 


D. The manufacturers of the devices installed hidden devices allowing them 
to film. 
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11. 


12. 


13. 


You are the network administrator for an IT training company that has over 20 
training rooms that are all networked together in their Miami office. Your 
corporate admin team could not access the internet last week as they were 
getting their IP settings from one of the training room's DHCP servers. The 
training manger has asked you to separate the corporate admin machines into 
their own network with a different IP range from the training rooms. What is the 
most secure way of implementing this? Select the best option from the following: 


A. Create a VLAN on the switch and put the corporate admin team in the 
VLAN. 


B. Install a router in the LAN and place the corporate admin team in the new 
subnet. 


C. Create a NAT from the firewall and put the corporate machines in that 
network. 


D. Install a proxy server. 


Your organization has many different ways of connecting to your network, 
ranging from VPN and RAS to 802.1x authentication switches. You need to 
implement a centrally managed authentication system that will log periods of 
access. Select the two most suitable methods of authentication from the 
following: 


A. PAP 

B. TACACS+ 
C. NTLM 

D. RADIUS 


What is the major benefit of using imaging technology, such as Microsoft WDS 
server or Symantec Ghost, to image desktop computers and laptops that are 
being rolled out from a security perspective? 


A. It provides a consistent baseline for all new machines. 
B. It ensures that all machines are patched. 
C. It reduces the number of vulnerabilities. 


D. It allows a non-technical person to roll out the images. 
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14. 


15. 


A company that is allowing people to access their internet application wants the 
people who log into the application to use an account managed by someone else. 
An example of such an arrangement is using their Facebook account with a 
technology called Open ID Connect. Which of the following protocols is this 
based on? Select the best choice: 


A. Kerberos 

B. SAML 

C. OAuth 2.0 

D. Federation services 


You are the security administrator for a medium-sized company that needs to 
enforce a much stricter password policy via group policy. The aims of this policy 
are to do the following: 

e Prevent using the same password within 12 password changes. 


e Ensure that they cannot change the password more than once a day. 
e Prevent weak passwords or simple passwords, such as 123456 or 
password, from being used. 


Select the options that you will need to fulfill all of these goals: 
A. Enforce password history. 
B. Minimum password length. 
C. Passwords must meet complexity requirements. 
D. Minimum password age. 


E. Maximum password length. 


16. You provide a service for people who have recently fulfilled their contract with 


their mobile phone provider to unlock their phone and then install third-party 
applications on it. They will then no longer be tied to using the mobile phone 
vendor's app store. Which of the following techniques will you use to achieve 
this? Select all that apply: 


A. Tethering 
B. Sideloading 
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C. Slipstreaming 
D. Jailbreaking or rooting 
E. Degaussing 


17. You are the security administrator of a multinational company that has recently 
prevented brute force attacks by using account lockout settings with a low value 
using group policy. The CEO of the company has now dictated that the company 
will no longer use account lockout settings as he read an article about it and got 
the wrong impression. Facing this dilemma, how can you ensure that you can 
make it more difficult for brute force to be successful? 


A. Obfuscation 
B. PBKDF2 

C. XOR 

D. berypt 


18. You want to join a wireless network by using a password. Which of the following 
wireless features would be most appropriate to achieve this objective? 


A. WPA2-Enterprise 
B. WPA2-TKIP 

C. WPS 

D. WPA2-PSK 

E. WPA2-CCMP 


19. What is the one main purpose of a network intrusion detection system (NIDS)? 
Select the most appropriate option: 


A. Identifies vulnerabilities 
B. Identifies new network hosts 
C. Identifies viruses 


D. Identifies new web servers 
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20. A web server was the victim of an integer overflow attack. How could this be 
prevented in the future? 


A. Install a proxy server. 

B. Install an SQL injection. 

C. Input validation on forms. 

D. Install a web application firewall. 


21. You have recently set up a new virtual network with over 1,000 guest machines. 
One of the hosts is running out of resources, such as memory and disk space. 
Which of the following best describes what is happening? 


A. Virtual machine escape 
B. End of system lifespan 
C. System sprawl 

D. Poor setup 


22. You are the system administrator for a multinational company that wants to 
implement two-factor authentication. At present, you are using facial recognition 
as the method of access. Which of the following would allow you to obtain two- 
factor authentication? Select all that apply: 


A. Palm reader 

B. Signature verification 
C. Thumb scanner 

D. Gait 


E. Iris scanner 
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23. 


24. 


25. 


The security auditor has just visited your company and is recommending that 
change management reduces the risks from the unknown vulnerabilities of any 
new software introduced into the company. What will the auditor recommend to 
reduce the risk when you first evaluate the software? Select the best two practices 
to adopt from the following list: 


A. Jailbreaking 
B. Sandboxing 
C. Bluesnarfing 
D. Chroot jail 
E. Fuzzing 


You are the security administrator for a multinational corporation. You recently 
detected and thwarted an attack on your network when someone hacked into 
your network and took full control of one of the hosts. What type of attack best 
described the attack you stopped? 


A. Man-in-the-middle attack 
B. Replay attack 

C. Packet filtering 

D. Remote exploit 


You are the security administrator for a multinational corporation and you 
recently carried out a security audit. Following the audit, you told the server 
administrators to disable NTLM on all servers. Which of the following types of 
attack best describes why you have taken this action? 


A. It will improve the server's performance. 
B. To prevent a man-in-the-middle attack. 
C. To prevent a pass-the-hash attack. 


D. To prevent a poodle attack. 
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26. The political adviser to the Prime Minister of the United Kingdom has returned 
from the two months of summer break that all staff are entitled to. He has 
applied for an immediate transfer to another department, stating that his health 
is bad and the job was far too intense. When his replacement arrives, he finds 
that, during the summer recess, the political adviser has shredded all documents 
relating to a political inquiry that has involved his cousin. The police are 
immediately called in and say that they cannot prosecute the political adviser 
due to lack of evidence. What precautions could the Houses of Parliament 
because of a security team take to prevent further events such as this happening 
in the future? 


A. Create a change-management document to ensure that the receptionists 
are more vigilant to people coming in out of hours. 


B. Enforce time-of-day restrictions so that nobody can access the IT systems 
during summer breaks. 


C. Enforce separation of duties to ensure that any document that is destroyed 
has been witnessed by a second person. 


D. Enforce mandatory vacations to prevent him coming in during the recess. 


27. You work in the forensics team of a very large multinational corporation, where 
an attack has happened across three different sites in two different countries. You 
have been collecting the following log files from these locations: 

e Firewall logs 


e NIPS logs 


e NIDS logs 


What is the first action that you need to take when collating these logs? 
A. Apply time normalization to these logs. 
B. Copy them into a worm drive so that they cannot be tampered with. 
C. Sort out the sequence of events by site. 


D. Raise chain of custody documentation for these logs. 
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28. You are an Active Directory administrator and have been having problems with 
the time synchronization that is used by the Kerberos authentication protocols. 
Consequently, you have now contacted a third party to provide your time 
synchronization. They use Stratum network time protocol (NTP) servers. What 
is the most secure method of setting up a Stratum server for time 
synchronization? 


A. The servers should connect to an internal Stratum 1 NTP server. 
B. The servers should connect to an internal Stratum 2 NTP server. 
C. The servers should connect to an internal Stratum 0 NTP server. 
D. The servers should connect to an external Stratum 0 NTP server. 


29. You are the network administrator for a company that runs an Active Directory 
domain environment where the system administrator is failing to keep you 
updated when new hosts are added to the network. You now decide that you 
will use your networking tools for the following tasks: 

e Identifying new hosts 


e Operating system versions 
e Services that are running 


Which of the following network-based tools provide the information that you 
require? Select the tools that you are most likely to use: 


A. Protocol scanner 
B. Microsoft baseline analyzer 
C. Nmap 


D. Penetration testing 
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30. 


31. 


32. 


You are working for the serious crimes unit of the United Nations and have been 
given a laptop to investigate. You need to ensure that the evidence you are 
investigating has not been tampered with during your investigation. How are 
you going to prove this to the court when it is time to present your findings? 
Which of the following techniques will you adopt to best prove this? Select all 
that apply: 


A. MD5 
B. 3DES 
C. SHAI1 
D. Blowfish 


You are the security administrator for a multinational corporation that has an 
Active Directory domain. What type of attack uses HTML tags with JavaScript 
inserted between the <script> and </script> tags? 


A. Cross-site scripting 

B. Man-in-the-middle 

C. Cross-site forgery attack 
D. SQL injection 


You are a system administrator working for a multinational company that has a 
Windows domain and is using an active passive model. Which of the following 
are the best reasons why your company would have adopted this model? 


A. It provides vendor diversity. 
B. It provides much faster disaster recovery. 
C. It is the best model to use for symmetric encryption. 


D. It provides availability of your IT systems. 
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33. You are the system administrator for an Active Directory domain and deal with 
authentication on a daily basis. Which of the following do you use as an 
authentication method by entering a PIN instead of a password? 


A. Smart card 
B. Kerberos 
C. WPS 

D. TOTP 


34. You are the security administrator for a large multinational corporation and you 
have a meeting with the CEO about the security posture of the company. He 
wants you to ensure that the following are carried out effectively: 


e Firewall logs are stored securely so that nobody can tamper with them 


e Elevation of privileges attack 


Which of the following is the best solution to implement? Select all that apply: 
A. Robocopy firewall logs to a worm drive. 
B. Robocopy firewall logs to a RAID 5 volume. 
C. Implement usage auditing and reviews. 
D. Carry out permission audits and review every seven days. 


35. You are the security administrator for a multinational company, and you know 
that one of your X509 certificates, used in at least 300 desktop machines, has been 
compromised. What action are you going to take to protect the company, using 
the least amount of administrative effort? 


A. Email the people involved and ask them to delete the X509 from their 
desktop immediately. 


B. Carry out certificate pinning to prevent the CA from being compromised. 
C. Revoke the root CA X509 so it is added to the CRL. 


D. Revoke the X509 so it is added to the CRL. 
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36. You need to install a new wireless access point that should be as secure as 
possible with the functionality of being able to be used for backwards 
compatibility with legacy wireless systems. Which of the following do you use? 


A. WPA2 PSK 
B. WPA 

C. WPA2 CCMP 
D. WPA2 TKIP 


37. You are the capacity planning administrator for a large multinational 
corporation, and find that Server 1 is running out of disk space and, when you 
monitor its network card, you see that it is at 100% utilization. Which of the 
following reasons best describes what is happening? 


A. There are hardware errors on the server. 

B. Unauthorized software is being downloaded. 

C. Event logs are getting full and slowing down the system. 
D. The disks that were selected were too small. 


38. You are the security administrator and someone has just tried to attack your web 
server, which is protected by a web application firewall. When you look into the 
log files of the web application firewall, two of the rows of the log file have the 
following two entries: 


var data = "<blackbeard> ++ </../etc/passwd>" 
Select* from customers where 1=1 


Which of the following attacks are most likely to be have been attempted? Select 
all that apply: 


A. Integer overflow 
B. SQL injection 
C. JavaScript 


D. Buffer overflow 
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39. 


40. 


41. 


Data has been classified as internal data and external data. The company recently 
added two new classifications of data: legal and financial. What would be the 
benefit of these new classifications? Select the best solution for the new data 
classifications: 


A. You need a minimum of three classifications for it to be effective. 
B. Better data classification. 

C. Quicker indexing. 

D. Faster searching. 


You are the security administrator for a multinational corporation based in 
Miami, and your company has recently suffered a replay attack. After learning 
the lessons following the attack learned, you have decided to use a protocol that 
uses time stamps and USN to prevent replay attacks. Which of the following 
protocols is being implemented here? Select the best answer: 


A. Federation services 
B. EAP-TLS 
C. Kerberos 
D. RADIUS federation 


Which of the following threat actors would be the most likely to steal a 
company's research and development data? 


A. Organised crime 
B. Competitor 
C. Script kiddie 


D. Nation state 
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42. 


43. 


44. 


You are a security administrator for a large multinational corporation based in 
the United Kingdom. You have just attended an annual seminar about the 
various types of password attacks. You have already disabled NTLM on all of the 
servers to prevent pass-the-hash attacks. Which of the following statements 
involves storing passwords as a hash value? 


A. A collision attack—the hash value and the data match. 

B. A collision attack—the hash values match. 

C. A rainbow-table attack performs a search of simple passwords. 

D. A rainbow-table attack performs a search of precomputed hashes. 


You are the new IT director of a small, family-owned business that is rapidly 
expanding. You have submitted your annual budget for the IT team and the 
owners of the company want to know why you have asked for funds for vendor 
diversity. They have asked you to provide two good reasons as to why they 
should grant you the funds. Which of the following are the most suitable reasons 
why you wish to implement vendor diversity? 


A. Reliability. 

B. Regulatory compliance. 

C. It is a best practice in your industry. 
D. Resilience. 


You are the network administrator for a large multinational corporation, and you 
have captured packets that show that the traffic between the company's network 
devices is in clear text. Which of the following protocols could be used to secure 
the traffic between the company's network devices? Select all that apply: 


A. SNMP V3 
B. SNMP 

C. SCP 

D. SFTP 
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45. 


46. 


47. 


You are the auditor of a large multinational corporation and the SIEM server has 
been finding vulnerabilities on a server. Manual inspection proves that it has 
been fully hardened and has no vulnerabilities. What are the two main reasons 
why the SIEM server is producing this output? 


A. There was a zero-day virus. 

B. False negatives. 

C. False positives. 

D. The wrong filter was used to audit. 


You are a forensic investigator who has been called out to deal with a virus 
attack. You collect the information from the network card and volatile memory. 
After gathering, documenting, and securing the evidence of a virus attack, what 
is the best method to prevent further losses to the company? 


A. Send a copy of the virus to the lab for analysis. 

B. Mitigate the attack and get the system back up and running. 
C. Initiate a chain of custody. 

D. Initiate business-impact analysis. 


You are the purchasing manager for a very large multinational company, and 
you are looking at the company's policy of dealing with the insurance of laptops. 
Last year, the company lost a record number of laptops. Your company is losing 
10 laptops per month and the monthly insurance cost is $10,000. Which of the 
following laptop purchases would prevent you from purchasing insurance? 


A. A budget laptop at $1,300 each. 
B. A budget laptop at $1,200 each. 
C. A budget laptop at $1,000 each. 
D. A budget laptop at $1,001 each. 
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48. Your company has suffered a system-sprawl attack, and you need to be able to 
identify what has caused the attack, and what the symptoms of the attack are. 
Which of the following attacks could cause system sprawl and what would be a 
tell-tale sign of it? Select the best two answers; each is a part of the solution: 


A. SQL injection 
B. DoS attack 
C. CPU at 100% utilization 
D. Buffer overflow 
49. Which of the following is a measure of reliability? 
A. MTTR 
B. MTBF 
C. MTTF 
D. RPO 


50. Which of the following are the characteristics of a third party to third party 
authentication protocol that uses XML-based authentication? Select the best three 
answers: 


A. Single sign on (SSO) 
B. Kerberos 
C. SAML 


D. Federation services 
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Security+ 501 Exam 


This guide is to help students pass the Security+ exam the first time round. More resources, 
such as flashcards, virtual machines, and PowerPoint slides are available 


at www. ianneil501.com. 


The CompTIA Security+ 501 exam is a very tricky exam and the only way to pass it is by 
having a solid knowledge base and good analytical thinking. 


The exam consists of 83 questions, lasts for 90 minutes, and the pass mark is 750/900, which 
equates to 83.33%. I think you can get maybe 12-13 questions wrong, but nobody knows 
how the exam is scored as scores in the 750s are even, yet scores of 760, 770, and 780 seem 
to be odd and don't increase in the same increments. 


The exam starts with simulations that are graphics, where you will drag and drop the 
answers, usually with four or five different sections. I believe that you get partial points for 
dragging in a correct answer. To get a look and feel of what a simulation looks like, google 
Security+ 401 exam simulations under images and many will appear. This will give you an 
idea of what to expect, but these simulations will be very different, as 501 is a different 
exam. 


This book is designed with open questions at the end of each chapter, since you need to 
know the material thoroughly to obtain certification. If we had used multiple choice all of 
the way through and you were good at guessing, you may have a false impression of your 
knowledge base. I will give you tips for the exam, followed by additional exam preparation 
material, including drag-and-drop practical exercises to help you tackle simulation types of 
questions, followed by some useful Linux commands. 


Tips on taking the exam 


When taking the exam, you need to read the questions thoroughly and look at their 
grammar, especially if you are a native English speaker, as we tend to scan, and your 
answer must meet the objective of the question. Adopt a subtractive method by first of all 
ruling out the answers that are wrong and then selecting the correct answer; the hardest 
way to tackle this exam is to immediately pick an answer. 


Preparing for the CompTIA Security+ 501 Exam 


As previously mentioned, the exam starts with simulations. If you are finding a question 
tricky, go to the top right-hand corner and there will be a button saying something like Flag 
for review, but do NOT attempt to answer that particular question. Do this with any 
question you find difficult, no matter how large or small it is. When you have finished the 
final question, you will automatically be taken to the review screen. Don't waste time 
working out a difficult question; mark it up, bank your points, and then give yourself a 
chance when you are less pressured. 


The review screen is larger than the display screen, therefore go to the top of the left-hand 
column and work your way down that column, then move onto the middle column, and 
the right-hand column. 


If you have not answered the review question, there will be a string in red saying 
something like You need to answer this question, making them very easy to spot. If you 
have answered the question, the review question will be a different shade of blue than the 
questions that haven't been answered; this can be tricky if you are color blind. When it asks 
you if you are finished with the review, scroll up to the top, where you should see 0/83 
questions. If it says 2/83, then this means that you have not answered two questions. If you 
cannot answer a question, give it your best shot since there is no penalty for entering a 
wrong answer; you never know, you may guess correctly. 


When you finish the exam, you will be taken to a few screens where you answer questions 
based on your profile. However, when it thanks you, and you press Next, that is the heart- 
attack moment, as your score will appear on the screen. In the middle of the screen, you 
will see a Security+ logo—look directly below it and look for the word 
Congratulations—this is all you need to see. Anything else is a bonus. 


Exam preparation 


An exam preparation guide with a checklist, drag-and-drop questions, and Linux 
commands is given here. Follow the checklist to ensure that you are as best prepared as you 
can be: 


Security +—Checklist 
Ensure you hit the mark before testing 


Task to complete Date completed 


Read chapter 1, Understanding Security Fundamentals, and score 

100% on review questions 
ttc 
review questions 
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Read chapter 3, Implementing Security Policies and Procedures, and 
score 100% on review questions 

Read chapter 4, Delving into Identity and Access Management, and 
score 100% on review questions 

Read chapter 5, Understanding Network Components, and score 
100% on review questions 

Read chapter 6, Understanding Cloud Models and Virtualization, 
and score 100% on review questions 

Read chapter 7, Managing Hosts and Applications Deployment, and 
score 100% on review questions 

Read Chapter 8, Protecting Against Attacks and Vulnerabilities, and 
score 100% on review questions 

Read chapter 9, Implementing Public Key Infrastructure, and score 
100% on review questions 


ter 10, Responding to Security Incidents, and score 100% 
questions 


ter 11, Managing Business Continuity, and score 100% 
on review questions 


Score 100% on mock exam 1 
core 100% on mock exam 2 


core 100% on drag and drop—authentication 
Score 100% on drag and drop—general 


Read and understand Linux commands 
Read all exam tips in the book 
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Practical 1—drag and drop—attacks 


Please place the answers against their description: 

Session hijacking—familiarity—whaling—DDoS—smurf—pharming—phishing—zero-day 
virus—tailgating—virus—replay attack—vishing—spear phishing—worm—man-in-the- 
middle—social engineering, urgency —XSS—ransomware—remote access Trojan—logic 
bomb—christmas tree attack—pass-the-hash—bluejacking 


Practical 1—drag and drop—attacks 
Put the correct answer against each item 


Preparing for the CompTIA Security+ 501 Exam 


Practical 2—drag and drop—certificates 


Please place the answers against their description: 


SAN—HSM—exchange keys—Wildcard—CSR—Bridge Trust 
Model—CRL—pinning—OCSP—PGP—Base64 format—Diffie-Hellman—P12—public 
CA—OID—key escrow—P7B—certificate template— .pfx—the faster it is but less 
secure— . cer—CA—architect—stapling 


Practical 2—drag and drop—certificates 
Put the correct answer against each item 


The CA used for b2b 


A certificate used on multiple servers with one domain 
Private key file extension 

Is my certificate valid? 

First part of encryption 

Public key file format 


A certificate used on servers in multiple domains 


Who signs the X509 certificates? 

Create new keys 

CRL is going slow, so we implement what? 
Private key format 

Prevent CA compromise 


X509 serial number 


Stores private keys 

PKI to PKI trust 

PEM 

Creates a secure tunnel 

Stores the keys for the key escrow 


Public key file format 


They build the CA and/or intermediary 
Web server bypassing CRL to go to OCSP 
Where is the X509 issuance policy held? 
What uses a web of trust? 


The smaller the key... 
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Preparing for the CompTIA Security+ 501 Exam 


Practical 3—drag and drop—ports/protocols 


Please place the answers against their description: 
636—21—443—389—UDP 161—22—5060 -53—989/990—5000—3389—UDP 
162—1900—22—443 137-139—993—445—23 -110—142—80—25—995 


Practical 3—drag and drop—ports/protocols 
Put the correct answer against each item 


imple network management protocol—secure 


ecure shell 
elnet 


Worm 
MAP 4 secure 
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Preparing for the CompTIA Security+ 501 Exam 


Practical 4—drag and drop—authentication 
factors 


Please place the answers against their description: 


Palm reader—federation 
services—PIN—Gait—PSK—password—London—WPS—fingerprint—natural 
signature—smart card—birth date—Kerberos—token—retina—swipe—Iris—federation 
services 


Practical 4—drag and drop—authentication factors—answers 
Put the correct answer against each item 


omewhere you are 


hird-party to third-party authentication 
AML—XML-based authentication 
omething you are 
omething you are 
omething you are 

Something you are 


Something you know 
omething you know 
omething you know 
omething you do 
omething you do 
omething you do 
revents replay attacks 


omething you have 


See ee 
Third-party to third-party authentication SSS SS 
SAML—XML-based authentication SSCS 
Sonethingyouare 
a 
Something youare 
ak ——<$ |. J 
Something youknow | 
Something youdo dd 
Something youdo 
Something youdo | 
a 
Wireless router password 
ec 
Sonethingyouhave 


[ 406 ] 


Preparing for the CompTIA Security+ 501 Exam 


Practical 5—drag and drop—general 


Please place the answers against their description: 


Stored procedure—SSO—disable account, reset password—screen locks—symmetric 
encryption—cable locks—2—office—standard naming convention—geotracking—protocol 
analyzer—banner grabbing—proximity card—on-boarding—3—group policy—input 
validation—double—single—strong passwords—cable 
locks—office—passwords—RFID—2—4 


Practical 5—drag and drop—general—answers 
Put the correct answer against each item 


Captures a command on a network 
Where you keep a safe 


Authentication—provides most errors 


Web server information 


Identity type of computer in a report 
Prevents SQL injection 


Prevents SQL injection 
RAID 0—minimum disks 


Where you keep keys 
Configures multiple settings on computers 


RAID 6—parity 


Policy used for BYOD commencing 
Kerberos authentication 


Prevents laptops being stolen 


Authentication for an office 
RAID 5—minimum disks 
Encrypts large amounts of data 


RAID 5—parity 


Finds a mobile device 


A person leaves—what do you do with the account? 


Prevents a device from being stolen from a ship 
Makes mobile devices secure 


RAID 1—number of disks 2. 
Prevents tablets from being stolen 


Makes mobile devices secure 
RAID 6—minimum disks 
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Preparing for the CompTIA Security+ 501 Exam 


Drag and drop—answers 


Put the correct answer against each item 
Directed IP broadcast to the borderrouter [Smurf 


An email to a group of people to getbank details _([Spear Phishing 

An email to one person to getbank details Phishing 

Letting someone you know access a secure area___—__[Familiarity 

Sending login details back to an attacker Remote Access Trojan 
Anattack using port445 | Ransomware 
Triggered by aneventoraction Logic Bomb 

An attack that NTLM is vulnerable to Pass-the-Hash 


A host flooded by multiple SYN flood attacks 


An attack using HTML tags and JavaScript SS 
aking control of someone's phone Bluejacking 


An attack for which there is no fix Zero-day virus 
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Preparing for the CompTIA Security+ 501 Exam 


Practical 2—drag and drop—certificates—answers 
Put the correct answer against each item 


The faster but less secure the 
encryption 
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Preparing for the CompTIA Security+ 501 Exam 


Practical 3—drag and drop—ports/protocols—answers 
Put the correct answer against each item 


1 
989/990 


HTTPS 
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Preparing for the CompTIA Security+ 501 Exam 


Practical 4—drag and drop—authentication factors—answers 
Put the correct answer against each item 
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N 


Natural signature 


Preparing for the CompTIA Security+ 501 Exam 


Practical 5—drag and drop—general—answers 
Put the correct answer against each item 


Office 
dentity type of computer in a report 
revent SQL injection 


revent laptops from being stolen Cable locks 

Authentication for an office 
ncrypts large amounts of data Symmetric encryption 

RAID 5—parity Single 


Geolocation 


revents a device from being stolen from a ship RFID 


Makes mobile devices secure Strong passwords 
Cable locks 


[ 412 ] 


Preparing for the CompTIA Security+ 501 Exam 


Linux information 


Although Linux is not mentioned in the exam syllabus, the Security+ exam is vendor 
neutral and the following commands may help you determine what is being asked: 


e Admin accounts: Root top level 

e sudo: Admin 

e su: Lower admin 

e Kill: Stops applications 

e us: List 

e Grep : Search 

e Pwd: Parent Working Directory 

¢ Chmod : Changes permissions 

¢ Mkdir: Make directory 

¢ SetFACL: Used to set permissions on a given file 
¢ Ifconfig: Equivalent of ipconfig 


IpTables: Firewall rules 


Chroot: Change root directory 


Root directories: /bin, /boot, /dev, /etc, /home, /mnt, /sbin, and /usr 
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Triple Digital Encryption Standard (3DES) 
Authentication, Authorization, and Accounting (AAA) 
Attribute-Based Access Control (ABAC) 
Access Control List (ACL) 

Advanced Encryption Standard (AES) 
Authentication Header (AH) 

Annualized Loss Expectancy (ALE) 

Access Point (AP) 

Application Programming Interface (API) 
Advanced Persistent Threat (APT) 
Annualized Rate of Occurrence (ARO) 
Address Resolution Protocol (ARP) 
Acceptable Use Policy (AUP) 

Asset Value (AV) 

Business Continuity Planning (BCP) 
Business Impact Analysis (BIA) 

Business Partners Agreement (BPA) 

Bring Your Own Device (BYOD) 
Certificate Authority (CA) 


Common Access Card (CAC) 


Acronyms 


Acronyms 


Cloud Access Security Broker (CASB) 

Cipher Block Chaining (CBC) 
Counter-Mode/CBC-Mac Protocol (CCMP) 
Closed-circuit Television (CCTV) 

Certificate (CER) 

Cross-over Error Rate (CER) 

Challenge Handshake Authentication Protocol (CHAP) 
Chief Information Officer (CIO) 

Computer Incident Response Team (CIRT) 
Content Management System (CMS) 
Continuity of Operations Plan (COOP) 
Corporate Owned, Personally Enabled (COPE) 
Contingency Planning (CP) 

Certificate Revocation List (CRL) 

Computer Security Incident Response Team (CSIRT) 
Chief Security Officer (CSO) 

Cloud Service Provider (CSP) 

Certificate Signing Request (CSR) 

Cross-Site Request Forgery (CSRF) 

Chief Technology Officer (CTO) 

Choose Your Own Device (CYOD) 
Discretionary Access Control (DAC) 
Distributed Denial of Service (DDoS) 


Data Execution Prevention (DEP) 
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Acronyms 


Distinguished Encoding Rules (DER) 
Digital Encryption Standard (DES) 
Dynamic Host Configuration Protocol (DHCP) 
Diffie—Hellman (DH) 

Diffie—Hellman Ephemeral (DHE) 
Dynamic Link Library (DLL) 

Data Loss Prevention (DLP) 
Demilitarized Zone (DMZ) 

Domain Name Service (Server) (DNS) 
Denial of Service (DoS) 

Disaster Recovery Plan (DRP) 

Extensible Authentication Protocol (EAP) 
Electronic Code Book (ECB) 

Elliptic Curve Cryptography (ECC) 
Elliptic Curve Diffie—Hellman Ephemeral (ECDHE) 
Encrypted File System (EFS) 
Electromagnetic Interference (EMI) 
Electro-Magnetic Pulse (EMP) 
Encapsulated Security Payload (ESP) 
End User License Agreement (EULA) 

File System Access Control List (FACL) 
False Acceptance Rate (FAR) 

Full Disk Encryption (FDE) 


False Rejection Rate (FRR) 
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Acronyms 


File Transfer Protocol (FTP) 

Secured File Transfer Protocol (FTPS) 

Galois Counter Mode (GCM) 

Gnu Privacy Guard (GPG) 

Group Policy Object (GPO) 

Global Positioning System (GPS) 

High Availability (HA) 

Hard Disk Drive (HDD) 

Host-based Intrusion Detection System (HIDS) 
Host-based Intrusion Prevention System (HIPS) 
Hashed Message Authentication Code (HMAC) 
HMAC-based One-Time Password (HOTP) 
Hardware Security Module (HSM) 
Infrastructure-as-a-Service (IaaS) 

Internet Control Message Protocol (ICMP) 
Intrusion Detection System (IDS) 

Institute of Electrical and Electronic Engineers (IEEE) 
Internet Information System (IIS) 

Internet Key Exchange (IKE) 

Instant Messaging (IM) 

Internet Message Access Protocol v4 (IMAP4) 
Internet of Things (IoT) 

Internet Protocol (IP) 


Internet Protocol Security (IPSec) 
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Acronyms 


Incident Response (IR) 

Incident Response Plan (IRP) 

Interconnection Security Agreement (ISA) 
Internet Service Provider (ISP) 

Information Systems Security Officer (ISSO) 
Initialization Vector (IV) 

Layer 2 Tunneling Protocol (L2TP) 

Local Area Network (LAN) 

Lightweight Directory Access Protocol (LDAP) 
Lightweight Extensible Authentication Protocol (LEAP) 
Monitoring-as-a-Service (MaaS) 

Mandatory Access Control (MAC) 

Media Access Control (MAC) 

Master Boot Record (MBR) 

Message Digest 5 (MD5) 

Mobile Device Management (MDM) 
Multi-Factor Authentication (MFA) 
Multi-Function Device (MFD) 

Multipurpose Internet Mail Exchange (MIME) 
Man-in-the-Middle (MITM) 

Multimedia Message Service (MMS) 
Memorandum of Agreement (MOA) 
Memorandum of Understanding (MOU) 


Microsoft Challenge Handshake Authentication Protocol (MSCHAP) 
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Acronyms 


Mean Time Between Failures (MTBF) 

Mean Time to Failure (MTTF) 

Mean Time to Recover or Mean Time to Repair (MTTR) 
Network Access Control (NAC) 

Network Address Translation (NAT) 
Non-Disclosure Agreement (NDA) 

Near Field Communication (NFC) 

Network-based Intrusion Detection System (NIDS) 
Network-based Intrusion Prevention System (NIPS) 
New Technology File System (NTFS) 

New Technology LAN Manager (NTLM) 


Network Time Protocol (NTP) 

Open Authorization (OAUTH) 

Online Certificate Status Protocol (OCSP) 

Object Identifier (OID) 

Operating System (OS) 

Peer to Peer (P2P) 

Platform as a Service (PaaS) 

Password Authentication Protocol (PAP) 

Port Address Translation (PAT) 

Password-based Key Derivation Function 2 (PBKDF2) 
Protected Extensible Authentication Protocol (PEAP) 
Privacy-enhanced Electronic Mail (PEM) 


Perfect Forward Secrecy (PFS) 
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Acronyms 


Personal Exchange Format (PFX) 

Pretty Good Privacy (PGP) 

Personal Health Information (PHI) 

Personally Identifiable Information (PII) 

Personal Identity Verification (PIV) 

Public Key Infrastructure (PKI) 

Padding Oracle on Downgrade Legacy Encryption (POODLE) 
Post Office Protocol (POP) 

Pre-Shared Key (PSK) 

Recovery Agent (RA) 

Registration Authority (RA) 

Remote Authentication Dial-in User Server (RADIUS) 
Redundant Array of Inexpensive Disks (RAID) 
Remote Access Server (RAS) 

Remote Access Trojan (RAT) 

Role-based Access Control (RBAC) 

Rule-based Access Control (RBAC) 

Rivest Cipher version 4 (RC4) 

Remote Desktop Protocol (RDP) 

Representational State Transfer (REST) 

Radio Frequency Identifier (RFID) 

RACE Integrity Primitives Evaluation Message Digest (RIPEMD) 
Return on Investment (ROI) 


Risk Management Framework (RMF) 
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Acronyms 


Recovery Point Objective (RPO) 

Rivest, Shamir, and Adleman (RSA) 

Recovery Time Objective (RTO) 

Real-Time Operating System (RTOS) 
Real-time Transport Protocol (RTP) 
Secure/Multipurpose Internet Mail Extensions (S/MIME) 
Software-as-a-Service (SaaS) 

Security Assertions Markup Language (SAML) 
Storage Area Network (SAN) 

Subject Alternative Name (SAN) 

System Control and Data Acquisition (SCADA) 
Security Content Automation Protocol (SCAP) 
Simple Certificate Enrollment Protocol (SCEP) 
Secure Copy (SCP) 

Small Computer System Interface (SCSI) 
Software Development Kit (SDK) 
Self-Encrypting Drive (SED) 

Structured Exception Handler (SEH) 

Secured File Transfer Protocol (SFTP) 

Secure Hashing Algorithm (SHA) 

Security Information and Event Management (SIEM) 
Subscriber Identity Module (SIM) 

Session Initiation Protocol (SIP) 


Session Initiation Protocol Secure (SIPS) 
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Acronyms 


Service Level Agreement (SLA) 

Single Loss Expectancy (SLE) 

Server Message Block (SMB) 

Short Message Service (SMS) 

Simple Mail Transfer Protocol (SMTP) 

Simple Mail Transfer Protocol Secure (SMTPS) 
Simple Network Management Protocol (SNMP) 
System on Chip (SoC) 

Sender Policy Framework (SPF) 

Spam over Internet Messaging (SPIM) 

Single Point of Failure (SPoF) 

Structured Query Language (SQL) 

Secure Real-Time Protocol (SRTP) 

Solid State Drive (SSD) 

Secure Shell (SSH) 

Service Set Identifier (SSID) 

Secure Sockets Layer (SSL) 

Single Sign-on (SSO) 

Terminal Access Controller Access Control System Plus (TACACS+) 
Transmission Control Protocol/Internet Protocol (TCP/IP) 
Ticket Granting Ticket (TGT) 

Temporal Key Integrity Protocol (TKIP) 
Transport Layer Security (TLS) 

Time-based One-Time Password (TOTP) 
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Acronyms 


Trusted Platform Module (TPM) 
User Acceptance Testing (UAT) 
Unmanned Aerial Vehicle (UAV) 
User Datagram Protocol (UDP) 
Unified Extensible Firmware Interface (UEFI) 
Uniform Resource Identifier (URD) 
Universal Resource Locator (URL) 
Universal Serial Bus (USB) 

OTG USB On The Go (USB) 

Unified Threat Management (UTM) 
Unshielded Twisted Pair (UTP) 
Virtual Desktop Environment (VDE) 
Virtual Desktop Infrastructure (VDI) 
Virtual Local Area Network (VLAN) 
Virtual Machine (VM) 

Voice Over IP (VoIP) 

Virtual Private Network (VPN) 
Video Teleconferencing (VTC) 

Web Application Firewall (WAF) 
Wireless Access Point (WAP) 

Wired Equivalent Privacy (WEP) 
Wireless Intrusion Prevention System (WIPS) 
Write Once Read Many (WORM) 


Wi-Fi Protected Access (WPA) 
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Acronyms 


Wi-Fi Protected Access 2 (WPA2) 
Wi-Fi Protected Setup (WPS) 
Exclusive Or (XOR) 

Cross-Site Request Forgery (XSRF) 
Cross-Site Scripting (XSS) 
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Assessment 


Mock Exam 1 


1. What type of attack is a padding oracle on downgraded legacy encryption 
attack? Choose two from the following list: 


A. IV attack 

B. Replay attack 

C. Man-in-the-middle attack 

D. TLS 1.0 with electronic code book 
E. SSL 3.0 with chain block cipher 
Answer: C and E 


Concept: A Poodle attack is a man-in-the-middle attack that exploits a 
downgraded browser using SSL 3.0 with CBC. 


2. You are the security administrator for the British Secret Service. What type of 
access method will you use for secret and top-secret data? 


A. DAC, with the owner of the data giving access 

B. DAC, with the custodian of the data giving access 
C. DAC, with the security administrator giving access 
D. MAC, with the security administrator giving access 
Answer: D 


Concept: MAC is used as the access method for classified data and the 
security administrator is responsible for giving users access to the data once 
the person has been vetted and access is justified. 


Assessment 


3. Your company wants to encrypt the DNS traffic by using DNSSEC. Once you have 
signed the zone, what records are created for each host? 


A. CNAME 


B. AAAA 
C. RRSIG 
D. Mx 

E. PTR 
Answer: C 


Concept: DNSSEC creates DNSKEY and RRSIG records. 


Wrong answers: 
A. CNAME is an alias. 
B. AAAA is a host record for IP version 6. 
D. An MX record is for a mail server. 
E. PTR records are created in the reverse lookup zone. 


4. You are a security administrator and a user called Ben is having a discussion 
with one of his colleagues. They have four choices for two-factor authentication. 
They have asked for your advice on which of the following involves two-factor 
authentication. Select the best answer: 


A. Smart card 
B. Password and PIN 
C. Passphrase and username 


D. Retina and fingerprint scan 
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Assessment 


Answer: A 


Concept: Two-factor authentication entails using two different groups of 
something you have, something you know, something you are, or 
somewhere you are. A smart card is something you have, but needs a PIN, 
which is something you know. 


Wrong answers: 
B. Both are something you know 
C. Both are something you know 
D. Both are something you are 


5. Two separate CAs need to work together on a joint venture; what can they 
implement so that certificates can be used for cross-certification? 


A. Bridge trust model 
B. Certificate pinning 
C. Certificate stapling 
D. Wildcard certificates 
Answer: A 


Concept: A bridge trust model is used where two root CAs are used to set up 
cross-certification. 


Wrong answers: 


B. Pinning prevents someone hacking the CA and issuing fraudulent 
certificates. 


C. Stapling is used by a web server that bypasses the CRL and use the 
OCSP for faster validation. 


D. Wildcard certificates can be used by multiple servers in the same 
domain. 
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Assessment 


6. John goes to a sports website and gets the following error: 


THIS WEBSITE CANNOT BE TRUSTED. 


What two actions does the website administrator need to take to resolve this 
error? 


A. Ask the key escrow to store his private key. 
B. Ensure that the website uses a valid SAN certificate. 


C. Update the root certificate into the client computer's trusted root 
certificate authorities store. 


D. Verify whether the certificate on the server has expired. 
Answer: C and D 
Concept: A certificate needs to be valid and trusted by the computer. 
Wrong answers: 
A. The key escrow only stores private keys. 
B. A SAN certificate can be used across multiple domains. 


7. Asecurity administrator discovers that an attacker used a compromised host as a 
platform for launching attacks deeper into a company's network. What 
terminology best describes the use of the compromised host? 


A. Brute force 

B. Active reconnaissance 
C. Pivoting 

D. Passing point 
Answer: C 


Concept: Pivoting involves using a weak host to launch an attack further into 
the network. 
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Assessment 


Wrong answers: 
A. Brute force is a password attack. 
B. Active reconnaissance is a penetration attack method. 
D. Passing point does not exist; it just sounds good—a red herring. 


8. Mary is managing the company's wireless network, which will use WPA2-PSK. 
What encryption is most likely to be used? 


A. SHA-1 
B. AES 
C. MD5 
D. DES 
Answer: B 
Concept: The encryption that WPA2 is most likely to use is AES. 
Wrong answers: 
A. SHA-1 is used for hashing. 
C. MD5 is also used for hashing. 
D. DES is not used by wireless technology. 


9. Who is responsible for setting permissions when using a Mandatory Access 
Control (MAC) model? 


A. The owner 

B. The manager 

C. The administrator 
D. The user 

Answer: C 


Concept: MAC gives access to data based on the file classification (for 
example, top secret); the security administrator sets permissions. 


[ 429 ] 


Assessment 


Wrong answers: 


A. Owners can give access using the DAC model, but once a classified 
document is written, it has no owner, and it is controlled centrally. 


B. Managers cannot grant any permissions to data. 
D. A user cannot grant access to any data. 


10. Company A is due to upgrade all of its IT systems and has been investigating 
moving to the cloud as there is no capital expenditure, since the CSP provides the 
hardware. Company A would still like to control the IT systems in the cloud. 
Which cloud model would best serve Company A's needs? 


A. Software as a Service (SaaS) 

B. Infrastructure as a Service (IaaS) 
C. Monitoring as a Service (MaaS) 
D. Platform as a Service (PaaS) 
Answer: B 


Concept: IaaS provides the bare metal hardware. Then you need to install 
the software, configure it, and patch it. 


Wrong answers: 


A. SaaS is where you lease a bespoke software package that is accessed 
through a web browser. 


C. MaaS is where someone monitors your network or applications for 
you. 


D. PaaS is a development platform in the cloud. 


11. You are a security administrator, and the IT director has tasked you with 
collecting the volatile memory on Server 1 as it is currently under a cyber attack. 
Which of the following are the two best forms of volatile memory to collect? 


A. Secure boot 
B. Swap/page file 
C. USB flash drive 
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Assessment 


D. ROM 
E. RAM 
Answers: B and E 


Concept: Always collect the volatile evidence before stopping a cyber attack 
in order to detect the source. Volatile memory evaporates if the power is 
switched off. RAM is volatile and the swap/page file is where applications 
run when RAM is full. 


Wrong answers: 
A. Secure boot checks that all drivers are signed on boot up. 
C. USB flash drives are non-volatile. 


D. ROM is non-volatile. 


12. Bill and Ben, the flowerpot men, are now going to encrypt data using asymmetric 
encryption, which uses public and private keys. What is the first step they need 
to take? 


A. Exchange public keys 

B. Exchange private keys 

C. Exchange digital signatures 
D. Exchange telephone numbers 
Answer: A 


Concept: The first stage in any encryption is key exchange, where you send 
your public key to someone else. 


Wrong answers: 
B. You should never give your private key away. 


C. You digitally sign the document and email using your private key to 
provide non-repudiation and integrity; they are never exchanged. 


D. Exchanging telephone numbers is just a red herring. 
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Assessment 


13. At what stage of the SDLC are computer systems no longer supported by the 
original vendor? 


A. Sandboxing 

B. End-of-life systems 
C. Resource exhaustion 
D. System sprawl 
Answer: B 


Concept: End-of-life systems are no longer operational or supported by the 
vendor. 


Wrong answers: 


A. Sandboxing is the isolation of an application for testing, patching, or 
isolation, as it is dangerous. 


C. Resource exhaustion is where a system has run out of resources. 


D. System sprawl is where a system is overutilizing resources and is 
heading toward resource exhaustion. 


14. Company A has just developed a bespoke system for booking airline tickets. 
What is it called if a freelance coding specialist tests it for security flaws? 


A. Code review 

B. Static code review 

C. Regression testing 

D. Dynamic code review 
Answer: C 


Concept: Regression testing is part of program development, and in larger 
companies is done by code-testing specialists. 
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Assessment 


Wrong answers: 
A. Code review is carried out on a regular basis to identify dead code. 
B. Static code review is done when the code is not being used. 
D. Dynamic code review is done when the code is running. 


15. You are the security administrator for a company that has just replaced two file 
servers. Which of the following is the best solution for disposing of hard drives 
that used to store top secret data? 


A. Hashing 

B. Degaussing 

C. Low-level formatting 
D. Shredding 

Answer: D 


Concept: You can shred a whole hard drive down until it looks like 
powder—let someone try to put that back together again. 


Wrong answers: 


A. Hashing does not destroy data; it merely says where integrity is 
intact. 


B. Degaussing should dispose of the data, but the better solution would 
be to totally destroy the hard drive itself. 


C. Low-level formatting replaces the tracks and sectors, but is not as 
effective as shredding. 


16. You are the security administrator for an airline company whose systems 
suffered a loss of availability last month. Which of the following attacks would 
most likely affect the availability of your IT systems? 


A. Spear phishing 
B. Replay 
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Assessment 


C. MITM 
D. DoS 
Answer: D 


Concept: DDoS and DoS attack the availability of IT systems, as they both 
aim to take them down. 


Wrong answers: 
A. Spear phishing is an email scam targeted at a group of people. 


B. Replay is an MITM attack that replays messages between two entities 
at a later date. 


C. MITM intercepts conversations between two entities, making them 
believe that they are talking to each other when they are actually talking 
to the attacker. 


17. You are a network administrator setting up a L2TP/IPSec VPN tunnel, as your 
company needs to move a large amount of encrypted data between the branch 
office and the head office. Why is Diffie-Hellman used for the IKE phase before 
the data is forwarded via symmetric encryption? 


A. It is a symmetric encryption technique that protects keys. 
B. It is a hashing technique that protects keys. 
C It is an ephemeral technique that protect keys. 


D. It is an asymmetric technique that protects keys, but sets up a secure 
channel. 


Answer: D 


Concept: Diffie-Hellman is asymmetric and has both a private and public 
key pair. Its role is not encryption but the creation of a secure tunnel for 
symmetric data to flow through and protect the only key from being stolen. 
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Assessment 


Wrong answers: 


A. Diffie-Hellman has two keys, while symmetric encryption has only 
one key. 


B. Hashing provides integrity of data, but you can still read it, so it 
doesn't actually protect it. 


C. Ephemeral techniques use short-lived, one-session-only keys. 


18. You are a lecturer at a college and you need to deliver a session on salting 
passwords. What are the two main reasons you would salt passwords? 


A. To prevent brute-force attacks 

B. To make access to the password slower 

C. To prevent duplicate passwords from being stored 
D. To stop simple passwords from being used 
Answer: A and C 


Concept: Salting passwords adds a random number to the password, 
making it longer in order to prevent brute-force attacks. This will prevent 
duplicate passwords, as each salt is different, and therefore each password 
will be unique as each will have a unique salt. 


Wrong answers: 


B. This is probably true, but is not a main reason. We don't salt for 
speed—we salt to protect the password. 


D. Salting cannot prevent someone from using 12345678 as their 
password, that would be password complexity. 


19. Which of the following methods of authentication is known as two-factor 
authentication? 


A. PIN and passphrase 
B. Mastercard and PIN 
C. Username and password 


D. Retina and facial recognition 
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Answer: B 


Concept: Two-factor authentication involves using two separate instances of 
something you have, something you know, something you are, or 
somewhere you are. A card is something you have and a PIN is something 
you know. 


Wrong answers: 
A. Both are something you know 
C. Both are something you know 
D. Both are something you are 


20. During a forensic investigation, the judge has decreed that any data that is 
investigated should remain in its original form of integrity. Which of the 
following is used for the integrity of data? Choose two: 


A. MD5 

B. AES 

C.SHA 1 

D. DES 

Answer: A and C 


Concept: Hashing is used to provide integrity of data; MD5 and SHA1 are 
two forms of hashing. 


Wrong answers: 
B. AES is used for encryption 


D. DES is used for encryption 
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21. Company A has suffered a DDoS attack, and the company has decided that their 
RPO should be set at four hours. The directors are holding a board meeting to 
discuss the progress that is being made. During this meeting, the IT manager has 
mentioned the Return Time Object (RTO), and the CEO looks confused. How 
can you explain the meaning of the RTO to the CEO? 


A. Acceptable downtime 

B. Return to operational state 
C. Measure of reliability 

D. Average time to repair 
Answer: B 


Concept: The RTO means that the system updates are running. This can also 
be known as the return to operational state. 


Wrong answers: 


A. Acceptable downtime is another way of saying recovery point 
objective. 


C. A measure of reliability would be the Mean Time Between Failures 
(MTBE). 


D. Average time to repair is the same as the MTTR. 


22. The following is a list of different controls. Which of these are physical security 
controls? 


A. Change management 
B. Antivirus software 

C. Cable locks 

D. Firewall rule 


F. Iris scanner 
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Answers: C and F 


Concept: You can touch physical security controls; therefore, cable locks are 
physical and the iris scanner is a physical device for biometric 
authentication. 


Wrong answers: 
A. Change management is an administrative control. 
B. Antivirus is a technical control. 


D. Firewall rules are technical controls. 


23. The security team has identified an unknown vulnerability and isolated it. What 
technique is best for investigating and testing it? 


A. Steganography 
B. Fuzzing 

C. Sandboxing 

D. Containerization 
Answer: C 


Concept: Sandboxing is where we put an application in an isolated virtual 
machine to test patches, or maybe just because the application is too 
dangerous to run on our network. 


Wrong answers: 


A. Steganography involves hiding a file, image, audio file, or video file 
inside another file, image, audio file, or video file. 


B. Fuzzing is a technique for inserting random data inside an 
application to test for vulnerabilities. 


D. Containerization is where data is isolated in a mobile phone to 
separate business data from personal data, such as pictures of family 
and friends. 
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24. What is it called when a user has exploited an IT system so that they have 
obtained access to all files on the file server? 


A. Remote exploit 

B. Zero-day exploit 

C. Privilege escalation 
D. Pivoting 

Answer: C 


Concept: Privilege escalation is where a normal user has obtained admin 
rights to access resources they should not normally be allowed to access. 


Wrong answers: 


A. A remote exploit scans a network for vulnerabilities and then attacks 
it. 


B. A zero-day exploit is where an exploit has just been discovered (on 
day zero), but there is not going to be a patch for it for maybe another 
2-3 days. 


D. Pivoting involves accessing a machine inside a network from which 
you can launch a second attack. 


25. You are the security administrator for your company, and the IT manager has 
asked you to brief them on XML authentication methods. Which of the following 
should you tell them uses XML-based authentication? Select all that apply: 


A. TOTP 

B. Federation services 
C. Smart card 

D. SSO 

E. SOAP 

F.SAML 
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Answer: A, B, and F 


Concept: SAML is an XML-based types of authentication used in federation 
services; TOTP is also XML-based. 


Wrong answers: 
C. A smart card uses X509 and a PIN for authentication. 


D. SSO means you sign in once and then gain access to all resources 
without putting your credentials in again. 


E. SOAP messages are used in SAML. 


26. There are a group of certificates in a folder and you need to identify which 
certificate uses the Privacy-Enhanced Mail (PEM) format. Which of the following 
is the best choice to make? 


A. PFX 

B. CER 

C. Base64 

DPI? 

Answer: C 

Concept: PEM uses Base64 format. 

Wrong answers: 
A. This is a private certificate. 
B. This is a public certificate. 
D. This is a private certificate. 


27. Three different companies want to develop an application where they will share 
the cost of developing resources and future running costs. Which cloud model 
best describes this? 


A. Public cloud 
B. SaaS 


C. Private cloud 
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D. PaaS 

E. IaaS 

F. Community cloud 
Answer: F 


Concept: Community clouds involve companies from the same industry 
developing their own cloud that they can then share resources on. 


Wrong answers: 
A. A public cloud is multitenant, and the tenants never share resources. 
B. SaaS is where a bespoke application is leased by different people. 
C. A private cloud is single tenant. They don't share with anyone. 
D. PaaS refers to a development platform, such as Azure. 
E. IaaS refers to leasing hardware. 

28. What type of key does a key escrow manage? 

A. Public 

B. Session 

C. Shared 

D. Private 

Answer: D 

Concept: The key escrow stores private keys for third parties. 

Wrong answers: 


A. The public key is used for encryption; it is always given away, but 
never stored. 


B. The session key is used for communication between two hosts. 


C. The shared key is used for symmetric encryption. 
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29. Which of the following is an email-based attack on all members of the sales team? 
A. Phishing 
B. Vishing 
C. Spear phishing 
D. Pharming 
Answer: C 


Concept: Spear phishing is an attack on a group of users. 


Exam tip: Whereas the plural of spear phishing is spear phishing, the 
65 singular can be phishing. 


Wrong answers: 
A. Phishing is an email attack against one person. 


B. A vishing attack is launched by using a telephone or leaving a 
voicemail. 


D. A pharming attack involves redirecting. 


30. An attacker tries to target a high-level executive, but has to leave a voicemail as 
they did not answer the telephone. What was the intended attack, and what 
attack was eventually was used? Select all that apply: 


A. Whaling 

B. Vishing 

C. Phishing 

D. Spear phishing 
Answer: B 


Concept: Vishing involves targeting a victim using a telephone or leaving a 
telephone message. 
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Wrong answers: 


A. This is not whaling, as the medium of attack was a telephone—don't 
be tricked. 


C and D. Phishing and spear phishing are email attacks. 


31. The auditor has been investigating money being stolen from a charity, and they 
have discovered that the finance assistant has been embezzling money, as they 
were the only person who dealt with finance, by receiving donations and paying 
all of the bills. Which of the following is the best option that the auditor should 
recommend to reduce the risk of this happening again? 


A. Hashing 

B. Job rotation 

C. Separation of duties 
D. Mandatory vacations 
E. Encryption 

Answer: C 


Concept: Separation of duties prevents one person from authorizing the 
whole transaction, and also prevents fraud. The CA signs the X509 
certificates. 


Wrong answers: 


A. Hashing ensures that data has not been tampered with, thus 
providing integrity. 

B. Job rotation prevents fraud; however, a charity may only have one 
person working in finance. 


D. Mandatory vacations prevent fraud, but require someone else who 
can deal with finance work. 


E. Encrypting data protects data, but has nothing to do with financial 
transactions. 


[ 443 ] 


Assessment 


32. You are a security administrator and you have now moved departments. You are 
now working with the certificate authority and training Mary, who is a new 
intern. Mary has asked you what the certificate Object Identifier (OID) consists 
of. What should you tell her? 


A. Certificate signing request 
B. Certificate pinning 

C. Certificate stapling 

D. Certificate serial number 
Answer: D 


Concept: The OID identifies the X509 itself. It is similar to a serial number; 
each X509 has a different OID. 


Wrong answers: 
A. A CSR is a request for a new certificate. 


B. Pinning prevents the compromise of the CA and the issuing of 
certificates. 


C. Stapling is where a web server goes directly to the OCSP for faster 
authentication, bypassing the CRL. 


33. You are the operational manager for a multinational corporation and you are 
writing a policy in which you mention the RPO. Which of the following is the 
CLOSEST definition to the RPO? 


A. Acceptable downtime 

B. Return to operational state 

C. A measure of the system reliability 
D. Average time to repair 

Answer: A 


Concept: The RPO is the amount of downtime your system can have without 
having access to its data. 
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Wrong answers: 
B. The return to operational state is the RTO. 


C. The mean time between failures is a measure of the system's 
reliability. 


D. The mean time to repair is the average time to repair. 


34. You are carrying out annual training about your company and need to put a 


35. 


PowerPoint slide together for the symptoms of a backdoor virus. Which three 
points will you include in the slide? Each provides part of the explanation of a 
backdoor virus: 


A. Programs will not open at all, even though you click many times. 
B. You must click on several items. 

C. Can be included in an email attachment. 

D. Files open quicker than before. 

E. You can only get infected through a link on a web page. 
Answers: A, B, and C 


Concept: Backdoor viruses can come in through email. They cannot install 
themselves; this is done by the users unwittingly installing a program. Once 
installed, the virus may prevent your programs from running. 


You are a security administrator and need to set up a new wireless access point 
so that it is not backward compatible with legacy systems, as these may be 
vulnerable to attack, and it must be the strongest encryption that you can use. 
Which is the BEST solution that meets your needs? 


A. WPA2 PSK 
B. WPA TKIP 

C. WPA2 TKIP 
D. WPA2 CCMP 
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Answer: D 


Concept: WPA2 CCMP uses AES, which is the strongest wireless encryption 
and is not backward compatible. 


Wrong answers: 


A. WPA2 PSK is for home users, where the wireless router password is 
used to connect to the wireless network. 


B. WPA TKIP is backward compatible. 


C. WPA2 TKIP is the strongest backward compatible. 


36. Which of the following commands can be used to create a buffer-overflow? 
Choose all that apply: 


A.var char 

B. strcpy 

C.var data 

D. streat 
Answers: B and D 


Concept: strcpy and strcat are used to copy and concatenate strings to a 
char array, and both can cause buffer-overflow, depending on the number of 
characters allowed. 


Wrong answers: 
A. var char sets the variable length of characters. 


C. var data sets the data type to be used in Java. 


37. James has raised a ticket with the IT help desk. He has been tampering with the 
settings on his computer and he can no longer access the internet. The help desk 
technicians have checked the configuration on his desktop and the settings are 
the same as everyone else's. Suddenly, three other people have also reported that 
they also cannot connect to the internet. Which network device should be 
checked first? 


A. Switch 
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B. Router 
C. Hub 

D. Repeater 
Answer: B 


Concept: A router gives you access to the internet; on a computer, it is 
known as the default gateway. 


Wrong answers: 
A. A switch joins resources on an internal network. 


C. A hub is an internal device that is slower than a switch, as it 
broadcasts traffic. 


D. A repeater is a device that extends cables beyond their length. 
38. Which of the following is a secure wireless protocol that uses TLS? 
A. NTLM 
B. PAP 
C. EAP 
D. AES 
Answer: C 
Concept: EAP-TLS is used for wireless encryption. 
Wrong answers: 
A. NTLM is a legacy Windows protocol. 
B. PAP stores passwords in clear text. 


D. AES involves symmetric encryption and is commonly used with 
L2TP/IPSec. 
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39. You are the security administrator for a multinational corporation, and the 
development team have asked for your advice as to how best to prevent SQL- 
injection, integer-overflow, and buffer-overflow attacks. Which of the following 
should you advise them to use? 


A. Input validation 

B. A host-based firewall with advanced security 
C. strcepy 

D. Hashing 

Answer: A 


Concept: Input validation controls the format and characters of data input 
and will prevent SQL-injection, buffer- overflow, and integer-overflow 
attacks. 


Wrong answers: 
B. A host-based firewall protects a desktop or laptop from attack. 


C. strcpy can cause buffer overflow if the string of data is larger than 
the maximum number of characters used in a data field. 


D. Hashing only confirms data integrity; it has no control over the input 
used. 


40. Your company is opening up a new data center in Galway, Ireland. A server farm 
has been installed there and now a construction company have come in to put a 
six-foot mantrap in the entrance. What are the two main reasons why this 
mantrap has been installed? 


A. To prevent theft 

B. To prevent tailgating 

C. To prevent unauthorized personnel gaining access to the data center 
D. To allow faster access to the facility 

Answer: B and C 


Concept: A mantrap provides a safe and controlled environment in the data 
center as it allows you to control access. 
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Wrong answers: 


A. Although this will be prevented, it is not the main reason; a 
mantrap's main purpose is to stop or control people. 


D. A mantrap will slow access to the data center. 


41. Which of the following devices can prevent unauthorized access to the network 
and prevent attacks from unknown sources? 


A. Router 

B. Load balancer 

C. Web security gateway 
D. UTM 

Answer: D 


Concept: A UTM is a firewall that can prevent unauthorized network access. 
It can also perform URL filtering, content filtering, and malware inspection. 


Wrong answers: 


A. A router can prevent access to the network based on the port, 
protocol, or IP address. 


B. A load balancer controls the volume of web traffic coming into your 
web server. 


C. A web security gateway prevents attacks on web servers. 


42. Internet of Things (IoT) is a concept that has recently taken off. Can you identify 
which of the following devices fall under this category? Select all that apply: 


A. ATM 

B. Banking system 
C. Smart TV 

D. Refrigerator 

E. Router 


F. Wearable technology 
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Answer: A, C, D, and F 


Concept: IoT involves small devices such as household appliances, wearable 
technology, and ATMs. 


Wrong answers: 
B. A banking system is not a small device; it is an IT system. 


E. A router is used to route packets and join networks together. 


43. Which feature of DNS will help balance a load without needing to install a 
network load balancer, or, when coupled with a load balancer, makes it more 
dynamic? 


A. DNS CNAME 


B. DNSSEC 


C. DNS round robin 


D. DNS SRV records 
Answer: C 


Concept: A DNS round robin is a redundancy used by DNS to ensure that a 
server is always available, even when it suffers from hardware failure. If you 
have three records for a web server, it will go from the first to the second to 
the third record and rotate back to the first again. 


Wrong answers: 


A. A CNAME is an alias; a shortened name for a host with an extremely 
long hostname. 


B. DNSSEC creates RRSIG records as it encrypts DNS traffic with TLS. 


D. SRV records help you find services such as domain controllers or 
global catalog servers. 


44. What is the benefit of certificate pinning? 


A. It prevents a certificate signing request from a non-administrator. 


B. It is used by a web server, and it bypasses the CRL for faster 
authentication. 
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C. It stops people from spoofing, issuing certificates, or compromising your 


D. It is used for cross certification between two separate root CAs. 
Answer: C 


Concept: Certificate pinning prevents people from compromising your CA 
and issuing fraudulent certificates. 


Wrong answers: 
A. A non-administrator can submit a CSR to obtain a new certificate. 
B. This is known as certificate stapling. 
D. This is known as a bridge trust model or a trust model. 


45. An auditor has just finished a risk assessment of the company, and he has 
recommended that we need to mitigate some of our risks. Which of the following 
are examples of risk mitigation? 


A. Turning off host-based firewalls on laptops 
B. Installing antivirus software on a new laptop 
C. Insuring your car against fire and theft 

D. Outsourcing your IT to another company 

E. Deciding not to jump into the Grand Canyon 
Answer: B 


Concept: Risk mitigation involves reducing the risk of an attack or event. 
These are basically technical controls. 


Wrong answers: 
A. This increases the risk, as it leaves your laptop vulnerable to attack. 
C. This is risk transference. 
D. This also is risk transference. 


E. This is risk avoidance, as it is deemed too risky. 
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46. A security engineer wants to implement a site-to-site VPN that will require SSL 
certificates for mutual authentication. Which of the following will you choose? 


A. L2TP/IPSec 
B. SSL VPN 

C. PPTP VPN 
D. IKEv2 VPN 
Answer: B 


Concept: SSL VPN is legacy that uses SSL certificates. SSL has been replaced 
by TLS as it is more secure. 


47. You are the Active Directory administrator and you have been training new 
interns on the Kerberos ticket granting session. One of the interns has asked 
about the relationship between a service ticket and session ticket used by 
Kerberos authentication. Which of the following is the best description? 


A. The user exchanges their service ticket with the server's session ticket for 
mutual authentication and single sign on. 


B. The service key is unencrypted and is matched with the value in the 
session ticket. 


C. The user shows the server their session ticket and the server sends him a 
service ticket. 


D. The user shows the server their service ticket and the server sends him a 
session ticket to keep. 


Answer: A 


Concept: Kerberos uses tickets for authentication, mutual authentication, 
and Single Sign On (SSO). Service and session tickets are exchanged for 
mutual authentication. The service ticket is encrypted. 


48. Your company has a guest wireless network that can be used by visitors during 
the day, the sales staff in the evening, and the customer service staff at lunchtime. 
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They set up a captive portal that fulfills the following criteria: 


e Guests do not need to authenticate. 
e Sales staff do not need to insert any credentials. 
¢ Customer service staff must use the highest level of encryption. 


How will you set up your captive portal? Select three answers; each answer 
provides part of the solution: 


A. WEP 40-bit key 

B. WPA2 TKIP 

C. WPA-TKIP 

D. Open-system authentication 
E. WPA2 CCMP 

F. WPS 

Answer: D, E, and F 


Concept: We use open-system authentication for the guest network as it 
requires no authentication. WPS is used for sales staff as they just need 
to push a button. Customer-services staff use WPA2 CCMP as it uses 
AES and is the highest level of WPA. 


Wrong answers: 
A. WEP should not be used as it is too weak. 


B. WPA2 TKIP is used for backward compatibility, and is not as 
strong as WPA2 CCMP. 


C. A weaker version of B. 


49. You are a security administrator, and the IT team has been using RSA for the 
encryption of all of their data, but has found that it is very slow. Which of the 
following should the security administrator recommend to improve the speed of 
encryption? 


A. Asymmetric encryption using DES 


B. Asymmetric encryption using Diffie-Helman 
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C. Symmetric encryption 
D. Running a vulnerability scan to find a better solution 
Answer: C 
Concept: Symmetric data is used to encrypt large amounts of data. 
Wrong answers: 
A. Totally wrong as DES is not asymmetric. 
B. Diffie-Hellman does not encrypt; it only creates a secure channel. 


D. Vulnerability scans are for missing patches, not encryption. 


50. Robert, who is an intern, has been assigned to the security team. A user has 
called him to ask who signs the X509 certificates. Which one of the following 
should Robert give as an answer? 


A. CRL 
B. Key escrow 
CoCsk 
D.CA 
Answer: D 
Concept: The CA signs the X509 certificates. 
Wrong answers: 
A. The CRL checks the certificate validity. 
B. The key escrow stores private keys for third parties. 


C. The CSR is the process of requesting a new certificate. 
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Mock Exam 2 


1. You are the security administrator for a large multinational corporation, and you 
have used a black box penetration tester to find vulnerabilities in your company 
and exploit them as far you can. During the penetration test, it was found that 
there were some vulnerabilities in your Windows 10 desktop operating system. 
There were no vulnerabilities in any of your Linux or Unix systems. Which of the 
following best describes why the penetration tester was successful with the 
Windows 10 machines, but not with the Linux or Unix machines? 


A. Linux and Unix are more secure than Windows 10. 

B. The penetration tester did not attempt to exploit the Linux/Unix machines. 
C. The Linux and Unix operating systems never have any vulnerabilities. 

D. The operating systems’ attack vectors are very different. 

Answer: D 


Concept: Different operating systems have different structures, so the attack 
vectors and the paths taken to attack them are different. 


Wrong answers: 
A. Not a proven fact—red herring. 


B. The penetration tests did attempt the exploit—that is why they had 
negative results. 


C. All operating systems suffer from vulnerabilities at one time or 
another. 


2. You are a security administrator and you wish to implement an encrypted 
method of authentication for your wireless network. Which of the following 
protocols is the most secure for your wireless network? 


A. PAP 

B. WPA2-PSK 
C. EAP-TLS 
D. PEAP 
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Answer: C 


Concept: EAP-TLS is a secure wireless authentication protocol, as it is uses 
certificates. It is the most secure EAP standard. 


Wrong answers: 


A. PAP shows the passwords in clear text and is used by VPN, not 
wireless networks. 


B. WPA2-PSK uses a wireless router password; therefore, it is not 
secure. 


D. PEAP encrypts EAP packets for secure wireless authentication, but it 
is not as secure as EAP-TLS. 


3. You are designing the network topology for a new company that is rapidly 
expanding from a one-premises company with 20 users to a medium-sized 
company with 300 users. The company tells you that it was subject to a DDoS 
attack last year that took the company down for over a day. In your network 
design, they don't want to implement a DMZ; therefore, the traffic will be coming 
directly from the internet. How do you propose to best mitigate against future 
DDoS attacks? Select two answers from the following list; each forms part of the 
solution: 


A. Install a stateless firewall on the edge of your network to prevent 
incoming traffic. 


B. Install a stateful firewall on the edge of your network to prevent incoming 
traffic. 


C. Install an NIDS in your network as an additional layer of protection. 

D. Install an NIPS in your network as an additional layer of protection. 

E. Install an inline NIPS in your network as an additional layer of protection. 
Answer: B and E 


Concept: A stateful firewall on the edge of your network can prevent a DDoS 
attack as it inspects the traffic, including the verbs. An inline NIPS will 
ensure that all network traffic coming from the firewall will go through it 
and be inspected thoroughly. 
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Wrong answers: 


A. A stateless firewall is a basic firewall that will prevent unauthorized 
access, but does not really inspect the traffic thoroughly. 


C. An NIDS cannot be an additional layer of protection, as it just detects 
changes in traffic patterns and cannot prevent attacks. 


D. Although installing an NIPS behind the firewall is a good idea, the 
inline NIPS is a much better solution, as all of the traffic passes through 
it. 


4. You work on the cyber security team of a large multinational corporation, and 
you have been alerted to an attack on the web server inside your DMZ that is 
used for selling your products on the internet. You can see by running net stat 
that you have an unknown active connection. What should be the first step you 
take when investigating this incident? 


A. Isolate the web server by disconnecting it from the network to prevent 
further damage. 


B. Disconnect all external active connections to ensure that the attack is 
stopped. 


C. Run a packet sniffer to capture the network traffic and identify the 
attacker. 


D. Take a screenshot of the damage done to the website and reporting it to 
the police. 


Answer: C 


Concept: The first stage in any attack is to capture the volatile evidence. In 
this incident you would capture the network traffic to identify the source of 
the attack. 


Wrong answers: 


A. Disconnecting the attack will prevent further damage, but will not 
identify the attacker and prevent it from happening again. 


B. Again, this option will not identify the attacker, but may instead stop 
legitimate customers. 
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D. A screenshot may not show the real damage being done, and will not 
identify the attacker. 


5. Ineed to purchase a certificate that I can install on five mail servers. Which one 
should I purchase? 


A. PEM certificate 

B. Wildcard certificate 

C. Subject Alternate Name (SAN) certificate 
D. Root certificate 

Answer: B 


Concept: A wildcard certificate can be used on multiple servers in the same 
domain. 


Wrong answers: 
A. PEM is a base64 format. 
C. A SAN certificate can be used in servers in different domains. 
D. A root certificate can only be used by a CA. 


6. You are the manager of a large IT company, and it is your duty to authorize 
administrative controls. Which of the following are actions that you would 
normally authorize? Select all that apply: 


A. Collecting an ID badge 

B. Creating an IT security policy 
C. Purchasing a cable lock 

D. Creating a new firewall rule 
Answer: A and B 


Concept: Writing policies, filling out forms, and anything to do with 
applying for ID badges are administrative controls. 
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Wrong answers: 
C. A cable lock is a physical control. 
D. A firewall rule is a technical control to mitigate risk. 


7. You are the operational manager for a financial company that has just suffered a 
disaster. Which of the following sites will you choose to be fully operational in 
the least amount of time? 


A. Cold site 

B. Warm site 
C. Hot site 

D. Campus site 
Answer: C 


Concept: The hot site should be up and running with data less than one hour 
old. 


Wrong answers: 


A. The cold site is the hardest site to get up and running, as it only has 
power and water. 


B. A warm site has non-critical data, and the data is about a day old. 
D. This is a red herring, and has nothing to do with disaster recovery. 


8. The serious crimes agency has just taken control of a laptop belonging to a well- 
known criminal that they have been trying to track down for the last 20 years. 
They want to ensure that everything is done by the book and no errors are made. 
What is the first step in their forensic investigation, prior to starting the chain of 
custody? 


A. Making a system image of the laptop 
B. Placing the laptop in a polythene bag and sealing it 
C. Hashing the data so that data integrity is assured 


D. Asking for proof of ownership of the laptop 
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Answer: A 


Concept: The first step is to create a system image; or, if it is a hard drive, 
create a forensic copy. 


Wrong answers: 
B. This is the second step. 


C. This is one of the steps when we start to investigate the contents of 
the laptop. 


D. This is not relevant. 


9. If an attacker is looking for information about the software versions that you use 
on your network, which of the following tools could they use? Select all that 


apply: 
A. Protocol analyzer 
B. Port scanner 
C. Network mapper 
D. Baseline analyzer 
Answer: A and C 


Concept: A Network mapper (Nmap) can identify new hosts on the 
network, identify what services are running, and identify what operating 
systems are installed. A protocol analyzer can tell what operating systems 
run on network hosts. This is sometimes called a packet sniffer. 


Wrong answers: 
B. A port scanner only tells you which ports are open. 


D. A baseline analyzer is a vulnerability scanner, and tells you about 
missing patches. 
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10. Footage of people relaxing in their homes started appearing on the internet 
without the knowledge of the people being filmed. The people being filmed were 
warned by relatives and coworkers, resulting in an inquiry being launched by the 
police. Initial evidence reported a that the victims had recently purchased IoT 
devices, such as health monitors, baby monitors, smart TVs, and refrigerators. 
Which of the following best describes why the attacks were successful? 


A. The devices' default configurations had not been changed. 


B. The victims' houses had been broken into and hidden cameras were 
installed. 


C. The victims' wireless networks were broadcasting beyond the boundaries 
of their homes. 


D. The manufacturers of the devices installed hidden devices to allow them 
to film. 


Answer: A 


Concept: loT home-based automated devices should have the default 
configurations of the username and password changed. 


Wrong answers: 
B. This would be very unlikely for so many people. 
C. This may be a possibility, but is unlikely to be the main reason. 


D. This would not happen, or the manufacturer would lose their market 
share. 


11. You are the network administrator for an IT training company that has over 20 
training rooms that are all networked together in their Miami office. Your 
corporate admin team could not access the internet last week as they were 
getting their IP settings from one of the training room's DHCP servers. The 
training manager has asked you to separate the corporate admin machines into 
their own network with a different IP range from the training rooms. What is the 
most secure way of implementing this? Select the best option from the following 
list: 


A. Create a VLAN on the switch and put the corporate admin team in the 
VLAN. 
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B. Install a router in the LAN and place the corporate admin team in the new 
subnet. 


C. Create an NAT from the firewall and put the corporate machines in that 
network. 


D. Install a proxy server. 
Answer: C 


Concept: A NAT hides the internal network from external resources and will 
separate the training machines from the corporate admin machines. 


Wrong answers: 


A. Putting a VLAN on the switch will segment the two networks, but 
it's not the best option. 


B. Installing a router creates a subnet and would also segment the two 
entities, but this is not the best option either. 


D. A proxy caches web pages and also filters traffic to and from the 
internet. 


12. Your organization has many different ways of connecting to your network, 
ranging from VPN and RAS to 802.1x authentication switches. You need to 
implement a centrally managed authentication system that will allow for long 
periods of access. Select the two most suitable methods of authentication: 


A. PAP 

B. TACACS+ 

C. NTLM 

D. RADIUS 
Answer: B and D 


Concept: AAA servers are used for centralized authentication as they 
provide authentication, authorization, and accounting, where they can 
record all log-ins and log-outs in a database. 
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Wrong answers: 


A. PAP is a weak authentication system where passwords are shown in 
clear text. 


C. NTLM is a weak authentication protocol that is susceptible to pass- 
the-hash attacks. 


13. From a security perspective, what is the major benefit of using imaging 
technologies such as Microsoft WDS or Symantec Ghost to image desktops and 
laptops that are being rolled out? 


A. It provides a consistent baseline for all new machines. 
B. It ensures that all machines are patched. 

C. It reduces the number of vulnerabilities. 

D. It allows a non-technical person to roll out the images. 
Answer: A 


Concept: When you build an image, all of the applications will have the 
same settings and updates and therefore will be consistent. A baseline 
consists of the applications that are installed at the current time. 


Wrong answers: 


B. Updates come out almost every week, so you will still need to patch 
an image, especially if it was taken a month or two ago. 


C. Vulnerabilities are discovered on a frequent basis, therefore this is 
not true. 


D. The fact is true, but from a security point of view it could pose a risk. 


14. A company that is allowing people to access their internet application wants the 
people who log into the application to use an account managed by someone else. 
An example of this is a user accessing their Facebook account with a technology 
called Open ID Connect. Which of the following protocols is this based on? Select 
the best choice: 


A. Kerberos 
B. SAML 
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C. OAuth 2.0 
D. Federation services 
Answer: C 


Concept: OAuth 2.0 is the industry-standard protocol for authorization. It is 
used by Open ID Connect, where people can be authenticated using their 
Facebook or Google account. 


Wrong answers: 
A. Kerberos is used only in Microsoft Active Directory. 
B. SAML is an XML-based authentication used in federation services. 


D. Federation services is third-party-to-third-party authentication that 
uses SAML, an XML-based authentication protocol. 


15. You are the security administrator for a medium-sized company that needs to 
enforce a much stricter password policy via Group Policy. The aims of this policy 
are to do the following: 


e Prevent using the same password within 12 password changes. 

e Ensure that they cannot change the password more than once a 
day. 

e Prevent weak passwords or simple passwords, such as 123456 or 
password, from being used. 


Select the following options that you will need to use to fulfill all of these goals: 
A. Enforce password history. 
B. Minimum password length. 
C. Passwords must meet complexity requirements. 
D. Minimum password age. 


E. Maximum password length. 
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Answers: A and C 


Concept: The password history is the number of passwords that you need to 
remember before you can reuse them. Password complexity requires users to 
use three of the four following characters in the password: lowercase, 
uppercase, numbers, and special characters not used in programming. A 
minimum password age set to 1 means that you can change the password 
only once a day, preventing password rotation until you get back to the 
original password. 


Wrong answers: 


B. Password length was a requirement, but the longer the password 
length, the longer it will take a brute force attack to crack. 


E. Ina Group Policy, there is no option for maximum password length. 


16. You provide a service for people who have recently fulfilled their contract with 
their mobile phone provider to unlock their phone and then install third-party 
applications on it. They will then no longer be tied to using the mobile phone 
vendor's app store. Which of the following techniques will you use to achieve 
this? Select all that apply: 


A. Tethering 

B. Sideloading 

C. Slipstreaming 

D. Jailbreaking or rooting 
E. Degaussing 

Answers: B and D 


Concept: Sideloading involves loading third-party applications onto an 
unlocked mobile phone. Jailbreaking (iOS), or rooting (Android), is where 
the phone has been unlocked, removing the vendor's restrictions on the 
mobile phone. 
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Wrong answers: 


A. Tethering involves connecting your phone to a laptop to give the 
laptop internet access. 


C. Slipstreaming is a technique for installing drivers into an . iso file. 
E. Degaussing involves passing a charge over a hard drive to erase data. 


17. You are the security administrator of a multinational company that has recently 
prevented brute-force attacks by using account lockout settings with a low value 
using Group Policy. The CEO of the company has now dictated that the company 
will no longer use account lockout settings as he read an article about it and got 
the wrong impression. Facing this dilemma, how can you ensure that you can 
make it more difficult for brute force to be successful? 


A. Obfuscation 
B. PBKDF2 

C. XOR 

D. bcrypt 
Answer: B and D 


Concept: PBKDF2 and bcrypt are key-stretching algorithms that insert 
random characters into password hashes, making them longer so that brute- 
force attacks need more processing and computation resources to crack 
them. 


Wrong answers: 


A. Obfuscation makes code obscure so that if someone steals your code, 
they cannot make sense of it. 


C. XOR (express OR) can be used to encrypt binary numbers. 


18. You want to join a wireless network using a password. Which of the following 
wireless features would be most appropriate to achieve this objective? 


A. WPA2-Enterprise 
B. WPA2-TKIP 
C. WPS 
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D. WPA2-PSK 
E. WPA2-CCMP 
Answer: D 
Concept: PSK uses the WAP password to join the network. 
Wrong answers: 
A. WPA2-Enterprise uses 802.1x with RADIUS for authentication. 
B. WPA2-TKIP is backward compatible with legacy devices. 
C. WPS pushes a button to access the network. 
E. WPA2-CCMP is the strongest encryption, as it uses AES. 


19. What is the main purpose of a Network Intrusion Detection System (NIDS)? 
Select the MOST appropriate option: 


A. Identifying vulnerabilities 
B. Identifying new network hosts 
C. Identifying viruses 
D. Identifying new web servers 
Answer: B 
Concept: NIDS identifies changes to the network and the network traffic. 
Wrong answers: 
A. This is the job of a vulnerability scanner. 
C. This is the job of a virus scanner. 


D. Web servers are not based in the LAN; normally, they are based in 
the DMZ. 
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20. A web server was the victim of an integer-overflow attack. How could this be 
prevented in the future? 


A. Install a proxy server. 

B. Install SQL injection. 

C. Input validation on forms. 

D. Install a web application firewall. 
Answer: C 


Concept: Input validation prevents buffer-overflow attacks, integer-overflow 
attacks, and SQL injection by restricting the input to a certain format. 


Wrong answers: 


A. A proxy server is used for web page caching and URL and content 
filtering. 


B. SQL injection is a form of attack where the phrase 1 = 1 is used ina 
script. 


D. A web application firewall is used to protect web servers and their 
applications. 


21. You have recently set up a new virtual network with over 1,000 guest machines. 
One of the hosts is running out of resources, such as memory and disk space. 
Which of the following best describes what is happening? 


A. Virtual machine escape 
B. End of system lifespan 
C. System sprawl 

D. Poor setup 

Answer: C 


Concept: System sprawl over-utilizes resources. This means that the system 
has started to run out of resources. 
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Wrong answers: 


A. Virtual machine escape is where an attacker uses a virtual machine 
so that they can attack the host. 


B. This is where a vendor no longer supports an application. 
D. This is where the configuration is not set properly. 


22. You are the system administrator for a multinational company that wants to 
implement two-factor authentication. At present, you are using facial recognition 
as the method of access. Which of the following would allow you to achieve two- 
factor authentication? Select all that apply: 


A. Palm reader 

B. Signature verification 
C. Thumb scanner 

D. Gait 

E. Iris scanner 

Answer: B and D 


Concept: Facial recognition is something you are for authentication. B and D 
are both something you do—you have a unique signature and your gait is 
how you walk. 


Wrong answers: 
A, C, and E all come under the something you are category. 


23. The security auditor has just visited your company and is recommending that 
change management to reduce the risk from the unknown vulnerabilities of any 
new software introduced into the company. What will the auditor recommend 
for reducing the risk when you first evaluate the software? Select the best 
practices to adopt from the following list: 


A. Jailbreaking 
B. Sandboxing 


C. Bluesnarfing 
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D. Chroot jail 
E. Fuzzing 
Answer: B and D 


Concept: Sandboxing and chroot jail allow you to isolate an application 
inside a virtual guest machine. 


A. This is the removal of the restriction that apple set on an iOS device. 
C. This is stealing contacts from a mobile device. 
E. This is putting random characters into an application. 


24. You are the security administrator for a multinational corporation. You recently 
detected and thwarted an attack on your network when someone hacked into 
your network and took full control of one of the hosts. What type of attack best 
describes the attack you stopped? 


A. Man-in-the-middle attack 
B. Replay attack 

C. Packet filtering 

D. Remote exploit 

Answer: D 


Concept: An exploit looks for vulnerabilities in a system; a remote exploit is 
someone coming from outside your network. 


Wrong answers: 


A. A man-in-the-middle attack is an interception attack where messages 
are changed in real time as they pass between two hosts. 


B. A replay attack is a man-in-the-middle attack where the messages are 
replayed at a later date. 


C. Packet filtering is used by a firewall to stop certain protocols from 
accessing your network. 
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25. You are the security administrator for a multinational corporation recently 
carried out a security audit. Following the audit, you told the server 
administrators to disable NTLM on all servers. Which of the following best 
describes why you have taken this action? 


A. It will improve the server's performance. 

B. It will prevent a man-in-the-middle attack. 

C. It will prevent a pass-the-hash attack. 

D. It will prevent a Poodle attack. 

Answer: C 

Concept: Disabling NTLM will prevent pass-the-hash attacks. 

Wrong answers: 
A. This is a red herring; it has nothing to do with performance. 
B. A man-in-the-middle attack is an interception attack. 


D. A Poodle attack is a man-in-the-middle attack that targets 
downgrade browsers—SSL3.0 CBC. 


26. The political adviser to the prime minister of the United Kingdom has returned 
from the two month of summer break that all staff are entitled to. He applied for 
an immediate transfer to another department, stating that his health is bad and 
the job was far too intense. When his replacement arrives, they find that during 
the summer recess, the political adviser shredded all documents relating to a 
political inquiry that involved their cousin. The police are immediately called in 
and say that they cannot prosecute the political adviser because of a lack of 
evidence. What precautions could the Houses of Parliament security team take to 
prevent further events such as this happening in the future? 


A. Create a change-management document to ensure that the receptionists 
are more vigilant about people coming in out of hours. 


B. Enforce time-of-day restrictions so that nobody can access the IT systems 
during summer breaks. 
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C. Enforce separation of duties to ensure that any document that is destroyed 
has been witnessed by a second person. 


D. Enforce mandatory vacations to prevent staff coming in during the recess. 
Answer: B 


Concept: Time-of-day restrictions would have prevented someone accessing 
the system during the holidays. 


Wrong answers: 


A. If the staff of the House of Commons are on holiday, then there will 
be no receptionists present. 


C. Separation of duties cannot be enforced during a shutdown period. 
D. Mandatory vacations cannot be enforced when nobody is working. 


27. You work in the forensics team of a very large multinational corporation where 
an attack has happened across three different sites in two different countries. You 
have been collecting the following log files from these locations: 

e Firewall logs 


e NIPS logs 
e NIDS logs 


What is the first action that you need to take when collating these logs? 
A. Apply time normalization to these logs. 
B. Copy them into a worm drive so that they cannot be tampered with. 
C. Sort out the sequence of events by site. 
D. Raise chain of custody documentation for these logs. 
Answer: A 


Concept: When collating forensic evidence, it needs to be put ina time 
sequence. In this case, we use time normalization to put it all in order. If 
we collect physical evidence from different computers, we use the 
record time offset to put the data and events in time sequence by using 
the regional time on the machine. 
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Wrong answers: 


B. Copying into a worm drive will prevent deletion, but not the 
analysis of data. 


C. This could be a first step, but it will not collate the information 
properly. 
D. A chain of custody would be needed once you hand the 


evidence to someone else, but it is too early at this time for this. A 
chain of custody records who has handled the evidence. 


28. You are an Active Directory administrator and have been having problems with 
time synchronization regarding the Kerberos authentication protocols. 
Consequently, you have now contacted a third party to provide your time 
synchronization. They use Stratum Network Time Protocol (NTP) servers. What 
is the most secure method of setting up a Stratum server for time 
synchronization? 


A. Having the servers connect to an internal Stratum 1 NTP server 
B. Having the servers connect to an internal Stratum 2 NTP server 
C. Having the servers connect to an internal Stratum 0 NTP server 
D. Having the servers connect to an external Stratum 0 NTP server 
Answer: A 


Concept: The time server must be internal. The Stratum 1 NTP server 


connects to the Stratum 0 NTP server, which is the ultimate time source. 
However, if there is no internal Stratum 1 NTP server, then we will use an 


internal Stratum 0 NTP server. 
Wrong answers: 


B. A Stratum 2 server can only connect to a Stratum 1 time server. 


C. Only use an internal Stratum 0 server when an internal Stratum 1 


server is not available. 


D. The connection to the time server should come from the internal 


network. 
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29. You are the network administrator for a company that runs an Active Directory 
domain environment where the system administrator is failing to keep you 
updated when new hosts are added to the network. You now decide that you 
will use your networking tools to do the following: 

e Identify new hosts 


e Identify operating system versions 
e Identify services that are running 


Which of the following network-based tools provide the information that 
you require? Select the tools that you are most likely to use: 


A. Protocol scanner 

B. Microsoft baseline analyzer 
C. Nmap 

D. Penetration testing 
Answers: A and C 


Concept: Protocol scanners and network mappers can identify new 
hosts, operating system versions, and services that are running. An 
NIDS can detect new hosts. 


Wrong answers: 
B. The Microsoft baseline analyzer is a vulnerability scanner. 
D. A penetration tester is trying to break into your network. 


30. You are working for the serious crimes unit of the United Nations and have been 
given a laptop to investigate. You need to ensure that the evidence you are 
investigating has not been tampered with during your investigation. How are 
you going to prove this to the court when it is time to present your findings? 
Which of the following techniques will you adopt to best prove this? Select all 
that apply: 


A. MD5 
B. 3DES 
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Cc. SHAI 
D. Blowfish 
Answer: A and C 


Concept: Hashing proves data integrity, and SHA1 and MD5 are both 
hashing algorithms. 


Explanation: When data is collected as part of a chain of custody, all data is 
hashed by SHA1, MD5, or HMAC. HMAC prior to looking through the data. 
When you finish the investigation you will run the hash a second time, if the 
hash matches then the data integrity is confirmed. 


Wrong answers: 


B and D are both used with encryption, not hashing. 


31. You are the security administrator for a multinational corporation that has an 
Active Directory domain. What type of attack uses HTML tags with JavaScript 
inserted between the script> and </script> tags? 


A. Cross-site scripting 

B. Man-in-the-middle 

C. Cross-site forgery attack 
D. SQL injection 

Answer: A 


Concept: Cross-Site Scripting (XSS) uses HTML tags with JavaScript. 
JavaScript can be identified by using the word var for variable—for 
example, varchar or var data. 


32. You are a system administrator working for a multinational company that has a 
windows domain and is using an active-passive model. Which of the following 
are the BEST reasons why your company would have adopted this model? 


A. It provides vendor diversity. 


B. It provides much faster disaster recovery. 
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C. It is the best model to use for symmetric encryption. 
D. It provides availability of your IT systems. 
Answers: B and D 


Concept: Clustering provides availability, and it has a quick failover to the 
passive host should the active host fail. 


Explanation: We would use an active-passive or active-active setup in the 
failover cluster so that if one node failed, the passive or second server would 
be up and running within seconds; users would not even be aware of this. 
This provides both faster disaster recovery and 99.999% availability, 
otherwise known as the five nines. 


Wrong answers: 
A. The cluster would come from the same vendor. 
C. Clustering is about availability—nothing to do with encryption. 


33. You are the system administrator for an Active Directory domain and deal with 
authentication on a daily basis. Which of the following do you use as an 
authentication method by entering a PIN instead of a password? 


A. Smart card 
B. Kerberos 
C. WPS 
D. TOTP 
Answer: A 
Concept: A smart card uses a PIN. 
Wrong answers: 
B. Kerberos can be accessed by entering a username and password. 


C. WPS is accessed by pushing a button to connect to a wireless 
network. 


D. TOTP uses a secret key or code. 
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34. You are the security administrator for a large multinational corporation and you 
have a meeting with the CEO about the security posture of the company. He 
wants you to ensure the following are carried out effectively: 

e The firewall logs are stored securely so that nobody can tamper with 
them. 


e Prevent elevation-of-privilege attacks. 


Which of the following are the best solutions to implement? Select all that apply: 
A. Robocopy firewall logs to a worm drive. 
B. Robocopy firewall logs to a RAID 5 volume. 
C. Implement usage auditing and reviews. 
D. Carry out permission audits and reviews every seven days. 
Answer: A and D 


Concept: Storing files on a worm drive prevents deletion. Continuous audits 
of permissions will help track escalations of privilege. 


Wrong answers: 


B. Storing data on a RAID volume is a solution for redundancy, but not 
the deletion of data. 


C. Account reviews may be quarterly, and so are not the best option. 


35. You are the security administrator for a multinational company, and you know 
that one of your X509 certificates, used in at least 300 desktop machines, has been 
compromised. What action are you going to take to protect the company, using 
the least amount of administrative effort? 


A. Email the people involved and ask them to delete the X509 from their 
desktop immediately. 


B. Carry out certificate pinning to prevent the CA from being compromised. 
C. Revoke the root CA X509 so it is added to the CRL. 
D. Revoke the X509 so it is added to the CRL. 
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Answer: D 


Concept: Once a certificate has been compromised, it should immediately be 
revoked so it is added to the CRL. 


Wrong answers: 


B. Certificate pinning cannot be set up after an event; it is set up to 
protect the CA against being compromised. This was only a low-level 
X509 that was compromised. 


C. There is no reason to revoke the root CA certificate as the certificate 
authority has not been compromised. 


36. You need to install a new wireless access point that should be as secure as 
possible while also being backward compatibile with legacy wireless systems. 
Which of the following would help you in this? 


A. WPA2 PSK 

B. WPA 

C. WPA2 CCMP 

D. WPA2 TKIP 

Answer: D 

Concept: WPA2 is the most secure and TKIP is backward compatible. 
Wrong answers: 


A. WPA2 is used to connect to the wireless access point using a 
password. 


B. Although WPA is backward compatible, it is not strong. 


C. Although WPA2 CCMP is the most secure, it is not backward 
compatible. 
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37. You are the capacity planning administrator for a large multinational 
corporation, and find that Server 1 is running out of disk space. When you 
monitor its network card, it is at 100% utilization. Which of the following reasons 
best describes what is happening? 


A. There are hardware errors on the server. 

B. Unauthorized software is being downloaded. 

C. Event logs are getting full and slowing down the system. 
D. The disks that were selected were too small. 

Answer: B 


Concept: Unauthorized software takes up disk space and causes high 
network utilization. 


Wrong answers: 


A. If there were hardware errors, no download would have happened, 
and there would not be a decrease in disk space. 


C. The event logs are text files and will not use up too much space. 


D. This is not a good choice as the disks that are purchased would be of 
a reasonable size. 


38. You are the security administrator and someone has just tried to attack your web 
server, which is protected by a web application firewall. When you look into the 
log files of the web application firewall, two of the rows of the log file have the 
following two entries: 


var data = “<blackbeard> ++ </../etc/passwd>" 
Select* from customers where 1=1 


Which of the following attacks are most likely to be have been attempted? Select 
all that apply: 


A. Integer overflow 
B. SQL injection 
C. JavaScript 


D. Buffer overflow 
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Answers: B and C 


Concept: An SQL injection attack uses the phrase 1 = 1. JavaScript is 
commonly used in XSS attacks and uses the var variable, so if you see var, it 
is most likely to be JavaScript. 


Wrong answers: 


A. Integer overflow is where larger numbers are used than should be 
used, normally with multiplication. 


C. Buffer overflow is where more characters are used than should be. 
The strcat and strcpy are applications that cause buffer overflow. 


39. Data has previously only been classified as internal data and external data. The 
company recently added two new classifications: legal and financial. What 
would be the benefit of these new classifications? Select the best solution for the 
new data classifications: 


A. You need a minimum of three classifications for it to be effective 
B. Better data classification 

C. Quicker indexing 

D. Faster searching 

Answer: B 


Concept: The more data classifications there are, the easier to classify it will 
be. 


Wrong answers: 
A. Data classification has no minimum values. 
C. Indexing will be slower for more classifications. 


D. Faster searching is done by reducing the amount of data. 
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40. You are the security administrator for a multinational corporation based in 
Miami, and your company has recently suffered a replay attack. After lessons 
learned, you have decided to use a protocol that uses time stamps and USN to 
prevent replay attacks. Which of the following protocols is being implemented 
here? Select the best answer: 


A. Federation services 
B. EAP-TLS 

C. Kerberos 

D. RADIUS federation 
Answer: C 


Concept: Kerberos issues tickets for authentication, and each change has a 
different Updated Sequence Number (USN) and time stamps. 


Wrong answers: 


A. Federation services use SAML, an XML-based authentication 
protocol. 


B. EAP-TLS uses certificates and is used for wireless authentication. 


D. The RADIUS federation is a federation that uses wireless as its 
method of access. 


41. Which of the following threat actors would be the most likely to steal a 
company's R&D data? 


A. Organized criminals 
B. A competitor 
C. A script kiddie 


D. A nation state 
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Answer: B 


Concept: The R&D department creates a lot of a company's trade secrets; 
therefore, a competitor would steal them to beat you to the marketplace. 


Wrong answers: 


A. Organized crime is most likely to target financial transactions rather 
than R&D data. 


C. A script kiddie reuses someone else's scripts. 


D. A nation state is more interested in attacking foreign governments 
than R&D data. 


42. You are a security administrator for a large multinational corporation based in 
the United Kingdom. You have just attended an annual seminar about the 
various types of password attacks. You have already disabled NTLM on all of the 
servers to prevent pass-the-hash attacks. Which of the following statements 
involves storing passwords as a hash value? 


A. A collision attack, the hash value, and the data match. 

B. A collision attack, the hash values match. 

C. A rainbow-table attack performs a search of simple passwords. 

D. A rainbow-table attack performs a search of precomputed hashes. 
Answer: B and D 


Concept: A rainbow table is a list of precomputed hashes. A collision attack 
is where two hashes match. 


Wrong answers: 


A. When a hash is created, it takes the data inside a file and turns it into 
a hexadecimal hash value—they don't match. 


C. This is false; look at the explanation of the concept. 
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43. You are the new IT Director of a small, family-owned business that is rapidly 
expanding. You have submitted your annual budget for the IT team and the 
owners of the company want to know what you have asked for funds for vendor 
diversity. They have asked you to provide two good reasons why they should 
grant you the funds. Which of the following are the most suitable reasons why 
you wish to implement vendor diversity? 


A. Reliability 

B. Regulatory compliance 

C. It is a best practice in the industry 
D. Resilience 

Answer: A and D 


Concept: Vendor diversity involves getting a service from two different 
providers at the same time. Vendor diversity provides reliability and 
resilience. For example, if broadband from one provider fails, then the 
second provider's broadband should still be up and running. 


Wrong answers: 


B. There are no regulations that say you must get services from two 
suppliers. 


C. It is not an industry best practice, though it may well be advisable. 


44. You are the network administrator for a large multinational corporation, and you 
have captured packets that show that the traffic between the company's network 
devices is in clear text. Which of the following protocols could be used to secure 
the traffic between the company's network devices? Select all that apply: 


A. SNMP V3 
B. SNMP 

C. SCP 

D. SFTP 
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Answer: A 


Concept: Traffic between network devices uses a simple network transport 
protocol; the secure version is SMTPv3. 


Wrong answers: 
B. SNMP is not secure. 
C. SCP copies files securely. 


D. SFTP secures downloaded traffic from FTP sites. 


45. You are the auditor of a large multinational corporation and the SIEM server has 
been finding vulnerabilities on a server. Manual inspection proves that it has 
been fully hardened and has no vulnerabilities. What are the two main reasons 
why the SIEM server is producing this output? 


A. There was a zero-day virus. 

B. False negatives. 

C. False positives. 

D. The wrong filter was used to audit. 
Answer: C and D 


Concept: If we are using the wrong configuration for the SIEM server, we 
will get poor monitoring, resulting in false positives. 


Wrong answers: 
A. A zero-day virus would not have been detected in the first place. 


B. False negatives allow attacks to happen, but are not detected. 


46. You are a forensic investigator who has been called out to deal with a virus 
attack. You collect the information from the network card and volatile memory. 
After gathering, documenting, and securing the evidence of a virus attack, what 
is the best method for preventing further losses to the company? 


A. Send a copy of the virus to the lab for analysis. 


B. Mitigate the attack and get the system back up and running. 
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C. Initiate a chain of custody. 
D. Initiate business-impact analysis. 
Answer: B 


Concept: Collecting the volatile evidence, mitigating the attack, removing 
the virus, and getting the system back up and running is the best thing to 
do. 


Wrong answers: 
A. This does not get you back up and running. 


C. A chain of custody records who has handled the evidence and does 
not get you back up and running. 


D. BIA only tells you the losses that you have incurred and does not 
generate any income. 


47. You are the purchasing manager for a very large multinational company, and 
you are looking at the company's policy that deals with the insurance of laptops. 
Last year, the company lost a record number of laptops. Your company is losing 
10 laptops per month and the monthly insurance cost is $10,000. Which of the 
following laptop purchases would prevent you from purchasing insurance? 


A. Budget laptops at $1,300 each 
B. Budget laptops at $1,200 each 
C. Budget laptops at $1,000 each 
D. Budget laptops at $1,001 each 
Answer: C 
Concept: 
SLE = ALE/ARO 
ALE = 12 x 10,000 = $120,000 
ARO = 12 X 10 = 120 laptops a year 
Single loss expectancy = $120,000/120 = $1000 
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Explanation: The cost of losing the laptops is $120,000, the same as 
purchasing the insurance. You should not take out the insurance in the hope 
that next year you may lose fewer laptops, as a record number of laptops has 
already been lost. 


Wrong answers: 


A, B, and D would cost more than the insurance; therefore, in these 
cases, you would do better to take out the insurance. 


48. Your company has suffered a system-sprawl attack, and you need to be able to 
identify what has caused the attack and what the symptoms of the attack are. 
Which of the following attacks could cause system sprawl and what would be a 
tell-tale sign of it? Select the best two answers; each is a part of the solution: 


A. SQL injection 

B. DoS attack 

C. CPU at 100% utilization 
D. Buffer overflow 
Answer: B and C 


Concept: System sprawl is when your resources are running out, for 
example, if your CPU was at 100% utilization. When your system is running 
like this, it could also suffer from DoS, which makes resources unavailable 
with too many SYN flood attacks. 


Wrong answers: 


A. An SQL injection attack involves placing the phrase 1 = 1 into a 
transact SQL script. 


D. A buffer-overflow attack involves putting more data into a field than 
it was programmed to handle. 


49. Which of the following is a measure of reliability? 


A. MTTR 
B. MTBF 
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C. MTTF 
D. RPO 
Answer: B 


Concept: Mean Time Between Failures (MTBF) is the measure of the 
number of failures. If I purchased a car and it broke down every day for the 
next week, I would take it back, as it would be unreliable. 


Wrong answers: 


A. MTTR is the mean time to repair. If I break down at 1 pm and it is 
repaired by 2 pm, the MTTR is 1 hour. 


C. MTTF is the mean time to failure; this is the lifespan of a piece of 
equipment. 


D. RPO is the recovery point objective. It is the amount of time a 
company can be without its data, meaning the acceptable downtime. 


50. Which of the following are the characteristics of a third-party-to-third-party 
authentication protocol that uses XML-based authentication? Select the three best 
answers: 


A. Single Sign-On (SSO) 
B. Kerberos 

C. SAML 

D. Federation services 
Answers: A, C, and D 


Concept: Federation services is a third-party-to-third-party authentication 
method that uses SAML, an XML-based method for authentication. It also 
provides SSO. This means that you only log in once in order to get access to 
resources. 


Wrong answer: 


B. Kerberos uses a ticket granting ticker = t and only works on a Microsoft 
Active Directory domain. 
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